Extracted

Extracted

• • Target
    20260729-000581.js
  • Size 115KB
  • SHA256 af9675e75f65e5b6e422306955c8b2b93c2ee0dfd53fbe72cc81e9eab11b701a
  • MD5 e58096a9cfbde64c357d48c1bde9c908
  • SHA1 7d674efb36c4c55dd9337a22f64301cfff95f1a1
  • SHA512 d59e0d9381ececc12f029d518c96c3f17cbacb942110c9fd844ed4dad3fca5909e868cdfa933e5f47a7dbd5e8a2ff266ce7f361470483fc78f75328b4bc48f7a
  • SSDEEP 3072:AUQDrAuFBakBX0P6NW3NjGzyF/UagTrFJ/u1FHvYSp:AvQKakBXo339GaDgTr61FHL
  • TLSH
    T11EC32A60D92506774F87BB9CBCA40660C57DC329892705B0FADD8B0D920A9ECF77D26B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2