Extracted

• • Target
    Inter.js
  • Size 956KB
  • SHA256 bba394138784bd11721f79f87664ab31018dec5efb8f5ca842898ba01be1bc12
  • MD5 bc512d6205e6fb4ff061503130744e07
  • SHA1 33d5e44ff6774fd1bcb7c01f1597872cb972ab84
  • SHA512 a7df07a67ee994b0a769320f81932357860369bd55cfb8e479a1cdac8ddb34b4df3e52f1634b685b02ad04a64f75a69c992f98fbf325a820447eb205b05b173c
  • SSDEEP 24576:DD8PD8AD8AND8oD8ED8ID8+D8hD867D8KD8KuD8oD8HDC8D8KD84D82D8VgDkD8w:DDeDLDZNDbD9D9D9DCDJ7DXDzuD7DQDQ
  • TLSH
    T15C253A70ED2407AA4F471B9EFCA50B9289BD8519822650F5F6DE074E60074FCE3FE269
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2