Extracted

• • Target
    Quotation.JS
  • Size 2.9MB
  • SHA256 1b341c92a2bc3e9081b16d2b2521d3b6415fd6d717c066593a172daf2885cf7c
  • MD5 26fb1c9c1e679c743f2d493c0a889bbd
  • SHA1 47c3720a608083c6916ddd393beaca77e302b183
  • SHA512 f5a0010eb1a77c3b4e84b98d9a09b7873eff2c15f21983ed4732009fbaf1740028cd6434e8a35a6b4690962a48f717a176bf9fdec5af6273ed9abde4c0634d2a
  • SSDEEP 49152:MGURS3nAph9sNeSQxwowW9MbacWX6+TXZBf97xdaB0KbnXxYgE/nBGNh62crh7:MGURS3n4h9pJw6MqZBf97xdaCKzXxYgs
  • TLSH
    T17CE53CA056087BB0AA3D672ED4276F080F2EF10BD254FE1F367C564477A675B22CD8A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2