Extracted

• • Target
    NEW ORDER VP0BH10M2026074147-CHINGUH SAMPLE ORDER.JS
  • Size 3.8MB
  • SHA256 7628528fb9512aa0f2db2ceab168c9a842f0de1b09c9572db5afdf1e69e5444a
  • MD5 66fb26c6ccf50ebb7856d664c948436c
  • SHA1 b3039f1cc5e6a5d564dca70bc59c92d8add592af
  • SHA512 a3dbf86d81e3694d10cc785cd1e9c23fbd191105f3ed8ec9460b366ebc3f548687ff43b1ab1b491855f94e0c9dde19e0c6ac5135726393f9c55ba8ac59696af7
  • SSDEEP 98304:lmbp3goX7vOjDQiVu70drJ0I/eDdQkhMUW7NyXKPDCZA+5Q7PrypUicEq:lmt3gk2DB0yJ0I/eDArPDCZA+5Q7zAUl
  • TLSH
    T11306C481479844FA7366974C2E7AEE60470A211314D5DF0A325FE7A8BE3DE079708BDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2