Extracted

• • Target
    Architectural_Floor_Plans.JS
  • Size 2.9MB
  • SHA256 99dc940e1b3ba041885dd9a89e2d24bf067713238e831ae3d415282ec98e07c0
  • MD5 93c1335673d61ff681305c1b736199ab
  • SHA1 9d14e01321ad95d81211ceb52916975961f62913
  • SHA512 a0c251ec9b0d8286824ac5e16fdf32eabbdf2b2fff1fcc1e8a72a1019b5418eaf63e21ee1f3bfe33346ca3e8041e2285821ba305d6a17f0ded1ee8692bcb886a
  • SSDEEP 49152:KsW4oRY52RaPtgTxPHkzIn6oY2lFtdyYYJfw9DLXKPstohk7wC7P/3qPra4PMiLy:KsW4UhRa1UPEzIn6oY2lFtd/8fw9DLXn
  • TLSH
    T121E508912784A1737B20BB9D923ADE749A0FA01355C2DF00756DEA04361DE8F6358FEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2