Extracted

• • Target
    DE-84864957.JS.js
  • Size 3.2MB
  • SHA256 b9d647bfa6a67364f3b0314999be9e60406569be4cdd1f0f7a0b838e45acede1
  • MD5 0d61f9134f38091ac044866f314eee35
  • SHA1 79618e1636aeee265526885e50e20370dd69d0f1
  • SHA512 353e33befa595222ba0d2c96ebbb5ec63f7e655203888ac2b6698c302271ce690397f97f3020c066d68b6b0033d9dd5ccd7b2834314c02a7863eb70ba6e497dc
  • SSDEEP 98304:0CnZa3j3Hwo8GIiA2QXHj6pW+YQn/5xHOzGt0Wmfvh7BfzBn2ooDWg:3ZGj3w3Gi2QuRDuHrnPk9
  • TLSH
    T111F538505768A172662EE36CD236EE38650E700324E9DF1D317DA324BA55E07A78CBF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2