Extracted

• • Target
    PRE ALERT DOCS AND MANIFEST.JS
  • Size 2.9MB
  • SHA256 32c0e2d4c15d7af5222b34d5a05c7c30c054f003a3881b33284261d9e80ecb61
  • MD5 1848fe1fe5814c8eb439ce3036fae646
  • SHA1 2e1dcf447654917347d750bff551be1a3cb58acb
  • SHA512 cec76f88ed56c7753adb355a28b52188ae0416a12d2080d72c22411b40296980b08666c2ac71554e4f4e1aed45e39959919338612a582b6eb93f5d0506233f85
  • SSDEEP 49152:a+euW7pAnVZpsVjvwCfQVpyIuANgFNEQiiaZHMFB+6ABgFWBGwF2EDByW601pbmv:0jpUv8lQVpjHiEQi12FBkXwwF2EDwW61
  • TLSH
    T102E5D3511788AD327321AB9C563AEDF0DA0A615315C6CF12306CF2587B2CD1BA76CBE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2