Extracted

• • Target
    Proforma Invoice No. 00124 - CONFIRM.JS
  • Size 3.3MB
  • SHA256 b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976
  • MD5 333b7c65d9d95c045d2847a95abffbed
  • SHA1 0631d8b428ef85e1ae5ca04460b7a7dd73f138b4
  • SHA512 09904c3c6c45957784da58b4bb8e5d849e8a3fa3ee7efd1637d951ec4b075c0014374daa10fd02d562440f4af964321b081fbb3bbcb795b90011a769400db6d3
  • SSDEEP 98304:wOdQf/H+qxoJAFkYimTGINWfM3m1bccdQm+bo0jqP+LbJMyr:wv/H+/m2pvIAfA5m6qWJMyr
  • TLSH
    T1F5F5C4421788A032777A679C533AE930D90B919714C9DF16347CD228BF6CE1793E8AF6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2