Extracted

• • Target
    Purchase Order - 123196.JS
  • Size 2.9MB
  • SHA256 a95d05b4e65068bbe109159b532397dff6b83e171aa160a2dd59992dfe1570cd
  • MD5 de9af8ff80ae361cb67c55e6f0f584c1
  • SHA1 4fdcef4ad4eddd627a36d13fdad9c4f7a9596cda
  • SHA512 7e4ce56037f38eafcf2e11337a9424baaa87a848f5d51962f974c825911e0451e3c4a84bab6406e8624545a25b8b979f155d5dc0cfcfe4a35a8c7d55aff46c2d
  • SSDEEP 49152:y5mvYXjro5DMHPA7VisydFKEiAi2vgD9KKjQqEbVWKuYmrt/vN3732htfZOhluLa:mX34MvmKdwEfi8VKjQqiEKuDB/vNrGRk
  • TLSH
    T1ADE5D5D11788A1727720ABAE563B9E709A1FA01319C2DF00366DE604771DD8FA35CFE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2