Extracted

• • Target
    Request for Quotation (RFQ) – CIF Offer.JS
  • Size 3.3MB
  • SHA256 f891f74a43809bc1774c27a6b425a46e265cf5f824196b59c6258cb177504408
  • MD5 0cb9458a7fdca2e0137dea9903092acd
  • SHA1 fb3b0d061dc7d947007a9001ef048d11a2e54df6
  • SHA512 3256884563805f300313f3bfc6a334c3e1ff0c5bb8243e92937e4f48864a51d6d1b04f4093cc13afa3ff15a5d652ecda9ad8eb0a3230f450d755bb719de5a0e6
  • SSDEEP 98304:yOB5Z0eH6k5XQPxRhhB4DaFLaL2qdkboZmrQMQyRTj86kPNizAjxPrpoNbXZImV:DyiQ5XkaJayMkWmrEyRS4kxTpoNFxV
  • TLSH
    T1EFF508B043897970A63E932CD4766E50871D3A076144AF1E3ABE1544FBE2716A7CC8FB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2