Extracted

• • Target
    Payment Confirmation.js
  • Size 537KB
  • SHA256 e5e6242c6da84bd44daddd5870cc95e53ee3e7b0e0021bb9d139194376b217ee
  • MD5 da73f74f4dc414fde296542928bbd8ca
  • SHA1 9a83f28fe9989d50a1a9878b11a7954b98b404fa
  • SHA512 8ed7a597aefd5598986176ed40d1015cb4c241645645754a8270b90eb861adb48bd1645588e6ae3a758a3ab62f85884d1d8afe54a388aad2dda19f6be05aa196
  • SSDEEP 6144:D5c1DiY3c7Hs/MA1y6nOBpR4/wBi2S7/d5pzpYSvmQHa61Nx1tb:UD/3wuLEUOpK/7/bMS1tb
  • TLSH
    T101C42D3DF0A9932978710620D7E1A252023EFD8F2F5F221426EE29CED3F55905A53DDA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2