Extracted

Extracted

• • Target
    Payment Copy Barnote 00357257778389920 .js
  • Size 27.7MB
  • SHA256 8ca2b192a6f30dc6a9834799e8ad24f2fbffaf123e2c8f3a668bdd00a6077c86
  • MD5 217a92dcf8bae3ed07ab82957f74fa6b
  • SHA1 c066da0a534949c48cafb96354e9407f896e626c
  • SHA512 b25083b77430eeba44617a590e89038a7a4c8bb8e3dd8e2d06bff8a84272e3716377aa6b5fd3e12ba29cee3d0c6a7c147b9d4314abfc2ee249980fd47f835a74
  • SSDEEP 6144:HTEtJagNJ6VEvHX1BEEfjeayFkRLAmSz7VzsSO44AHXtAfrjs+s8u4DnruzaAdnD:Z
  • TLSH
    T1695740156048F03FD7DFC8C366128EF99106F702C78AB617C69DAEE81E2DABAD507152
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2