Extracted

• • Target
    Overdue Invoices.JS
  • Size 2.9MB
  • SHA256 fe8224fd506c5e1dfd8739bdbb2c6d19b0449e6a4788485c2bb348ae0e55f1fd
  • MD5 5b3b27da8418c6c429e585dd9de7dde8
  • SHA1 90c75d08e9e8faef67270839344125e6e2c99d94
  • SHA512 7d28904638c93f81c2744d0c070b6638ebdad76497bc9fe76388066d9c1ce9764df19bfcb84f67c4557f2679be935fd08d6760c0c51b6c422762f3d49edc1eda
  • SSDEEP 49152:4LbeTWIQ3PWLV9xH2CLzCy8M6+rL0E23tx220Gl/i8RMvuJ5Et52daduoY8gnMQN:CyTWIQ/WLV9xH2CLzCy8M6+rLR23tx2a
  • TLSH
    T160E5078167C495B27720AB9E523ADE30990FE0431DC1DF00766EE708366DD9FA368AD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2