Extracted

• • Target
    INQUIRY P08026EJFCHINA.JS
  • Size 3.3MB
  • SHA256 fd4ec7aba61e4ee51d147c107e61715167127035bbfa7723149598f3aec9b3c4
  • MD5 4afae1a3d47a9d1290888535e603d0d9
  • SHA1 97845195bf7d44e5be82a570a2b6b14dc207f3f6
  • SHA512 a7df5f613e0d0ec0eb45965a1f7bda8d3ed31fde303a6545e3e6b2c240e4bf5c437d72d1ed5aa7a36c45c9d5695884ab9eaf491797fd177e1e370e55b1f67392
  • SSDEEP 98304:Xt9XgwGcX5iduoHQaih45v38pncEc0msmoARayCR7tgolNTpxtW:99LGC9vhK8pfxmnVC9t7lNTp3W
  • TLSH
    T153F5D64A53D4A0337731775C9236EA31E55A1A1312D5CF22307ED308BBADD4BA358BEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2