Extracted

• • Target
    NEW ORDER No.974TABTO510.JS
  • Size 3.5MB
  • SHA256 ac0e81da75c8646e73db4a8b6fa2d3d9d3e1a327864cfb0b723967f22d527778
  • MD5 8feb0c559471f8fcf2eb4a87288f82fa
  • SHA1 a0e2911b7c1d821b65aff9f7dc8cc6aa1c9784db
  • SHA512 20eb2fa4739e18c3d83005960ded12e7d5da6d69b0440bdc6a6f6f7eef9f91c2a8346b936bd61d72d1929da57d0af178beff7652565d04fed37d33e8cd760b83
  • SSDEEP 98304:bK8XE22nbioXjjjPmYOGzPpWuJfPtdku222p9EkXyba4SNVFkA25Oue2o+gDTZc9:e852nbFPjPlOGTpWuZPtdhKHXyba4SNG
  • TLSH
    T1C806E750270968307E3E972CD9369A94AF4D210323C4EF1E357D1668BBE1A5793ACCF6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2