Extracted

• • Target
    Urgent_Requirement.JS.js
  • Size 2.9MB
  • SHA256 85269163ce84b80ed9408c3538054b42e6aa035b7c7b1c496cdabb9acf87a7f1
  • MD5 c04a92d4145681e8e4ad3111e055e208
  • SHA1 7b2b824fc2bba663bcd69d0d08d9adb9d22ea69f
  • SHA512 40708226d5d5c0335eed3c1574bab6ef15820a2196d1ca4882e43c54c1960dbe0a58093403da20e2c9e1d9d34477865ddd8dc5d73576762b23b08f543b678e99
  • SSDEEP 49152:cqfNGfN8AWKHD5YLcN1cAkkpy+dkHowmoSEx0H+laMWC3Pxmnb8IgrGogfwNggIe:/k6AWKHD5YLOpkkQ+WmoSEx0H+lajC3F
  • TLSH
    T135E5D5512785AC327331AB9C523ADDF0A90A615325D6CF1630ACF2187B6CD1BA758BF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2