Extracted

Extracted

• • Target
    PurchaseOrder-37851.js
  • Size 1.0MB
  • SHA256 18fddcf08bcfa108776f316b823669a82836e4c20526b3fc0a0e5433b63ef689
  • MD5 c6605d86bf81a47f95915eb347648b62
  • SHA1 69bd31c25d230b672ca2dad2990634b4602a7596
  • SHA512 9444200be72cc82f8e79d6f7c162b9e4481c725621e1a20d06d3752896fd95558d0fac4482e975ca635b5912f7c4704476ac37adce5cd904034fce9ca768ebf6
  • SSDEEP 384:VY4Os98Y3qK7nf98OWRsmyqZXCK8M8vcY3LcXnD4/n2aw+jMjG+ZwGs/FZu:j6Kj7E
  • TLSH
    T12835F1B12D894C19C3079650FC15D77EA532E42E85CCAB5E7AEDCF50286732960BE82F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojanadwareransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2