Extracted

• • Target
    Quotation J70926.js
  • Size 1013KB
  • SHA256 e177832273e9347afe9af00a28c4c53a092bb8e86f34b452b363018ac9500969
  • MD5 64491953187a24e53fec6871be3e5e46
  • SHA1 b2d527656c62685a5f1325b9f0594be3cfcf31ad
  • SHA512 9a7c0df81babfdbe5801bf8311101dc74bb9cbb3a5c309a7b988a9fe21b6a828263a0e782601213e1aa93dc5612bed142fdd6656710fb0cda1793cab1e353c79
  • SSDEEP 12288:hcBYx96k1rPAPKSAEqn6KloLGtUnYX0CsJpkus24hu7Z8ogGgU3yBiCMyJ8y4QSj:o
  • TLSH
    T15625FDDB9FB5D69906297D6EC87CBE9D248BCD9000D0AA5BFDB88147F30E64502C4B1E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2