Extracted

• • Target
    PO 4513101479.pdf.JS
  • Size 3.5MB
  • SHA256 243de5e93436d84b56e6a629552483b5cc0c2e95823fe465f546a443a55a60f0
  • MD5 99b14e845109b728ba212e35983aa2da
  • SHA1 306df6e594c72bd8f59d9580cbeb5a5756acdec5
  • SHA512 142972fb992a53d4dc18acae2fc1ef1e6a967980d1759e815cab9167ed9cd5b7f8fed34af27b0fc8e9e47854fa73144a70ffd2fd1ef7efc301f913c21e109fdf
  • SSDEEP 98304:oHlGHMCZtVuSm36/SBlwd+wDN72Eo2jXUnI3A3IvG8yivQTZ4xE3NoDnsPKsSpW:oXCAm+wd+sN2eknMA2QsE9gsPpj
  • TLSH
    T1A1065B58A520A38705D4E33BE506FFFD970E583B3C6C9E4B746E8839848EF857A51293
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2