Extracted

• • Target
    発送 MR-156528.JS
  • Size 3.3MB
  • SHA256 fe109a9a24843e7f34d32bc715342fdd019ae3c6df308af4a581f130c89c0872
  • MD5 6bb802895b427ca1868e6e0dd525ad61
  • SHA1 1352a34a94dec7133171c97ed9dbca4b175b4c00
  • SHA512 b91dfdf1a1ed027d6a754b722c9720924c133e964854d743626b777c4ca2004eb0c00e60b5eb8ee15e3e11b734dfd577be167a4b03cab4cb448374bc2c0a4fc3
  • SSDEEP 98304:+Ai4JsdG0GKxETqakiOnrRBqOUYWwoTXWNiaAm7uYEXMIuW:+h4J6dGKxET3pOnVBQYWwQoAal8uW
  • TLSH
    T104F5B3601785A13273396B5C62BAED20D60A522358C5DB13307DE20D7B6CD27A76CFFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2