Extracted

• • Target
    ORDER #50678.JS
  • Size 3.8MB
  • SHA256 1e9798a8d50cbd07d29b1ad66932df6b2acebaf59fd4755cb1260cf106f4d5f6
  • MD5 18aae6c8971c90c774ab4c39c6acd62b
  • SHA1 3c1e7146fa1ccba104fabf08bd927c20113b349e
  • SHA512 187dd0fdf6ee84dee7a3a98865d1a706ab5cfa1741761870228b296571646521efc313a4bad6a3b72e1f913c83b66dacbbfc7e5fcc37df3b8c00ec64302c00aa
  • SSDEEP 98304:uGg7mn0vb1Sy6T+sjH2ujqvRXPUa68k6oNX63WvoYe5mx2r:u5IjqZXPU08XUmxI
  • TLSH
    T1E106F9845A5848B8666FD30CD87BF6440BED23138018BF5FB879196CB792E0B671E4DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2