Extracted

• • Target
    SWIFT_Payment_Confirmation_Final_SOA.pdf.JS
  • Size 2.9MB
  • SHA256 7fb37defc5f4c9ad326e8c37cbd4afae1efc5affca59c0f6239ff2f580ccdda1
  • MD5 c5759e6d562d0e4cfe6de9f729e21233
  • SHA1 e2a9ef2e7ce877c26a1f324252f7dae94fa2ec4a
  • SHA512 6dfaa5be2968b54d7766262b6ca2b2859e5a88195777cffdb01fc383356efcfce9e13867a0baf01b597e2f1d31f28ecadee38355464833c730a5d31204b38ad1
  • SSDEEP 49152:MiIvzJczrZ5oLfjCdYvyFDvQulLwPiLyxnbMnOofpcKNWajChBjZMWxA8Yv8YMC6:AvzKzrZEWPp3LZyxKPhrW8ChBjiWx4vG
  • TLSH
    T162E5F5411785AC7373356B9D9236D9F0A90AA11314C6DF0630ACF2287B6CE1BA75CEF6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2