Extracted

• • Target
    RFQ-1579.JS.js
  • Size 2.9MB
  • SHA256 98b345d171d2ebf1105b033729ef580541226b3a355957e6e03a852c7ab36615
  • MD5 db863603fd19e8737abcb2b0fbcd83c1
  • SHA1 aad65f18dfec552d36bad3939b234170ec913954
  • SHA512 2ec716028c82d0267c7f031d883b75b2d34afa2db59b19a55b6858f686ef5997fd00e5ca9de16318779a04d1d4bd6c6aae85d5f2e47b20e2fd3664e08dfe58e1
  • SSDEEP 49152:x4e/1ugw+XK5oeLgUBZYnzxC/TP+4ulBxfT3H+63aw5JjUag4505I5pN4M7rWjnV:JNug7XKSeL1BT/a4u3x73H+63aw5JjHW
  • TLSH
    T169E5F690530899B27A2C672CE137DE244B1EB01351C5EF5D377CA608B795EAF638C8E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2