Extracted

• • Target
    PO.JS.js
  • Size 2.9MB
  • SHA256 0846638011c26f1ad2107311aef7d359aac55e4f81477af41a80b03838ad2a70
  • MD5 50c29a2225cdd6b0a7fdb712d9c36d53
  • SHA1 f0ae382162a2cf7d2e038202beb563affab65205
  • SHA512 b9797f3333d51196dfafc1373e376869630793e28eac122f77a21fb9dddd5b77049f2f2b0a5aa6cfe2986e3de4e9b991f5549e3a7af4ce226bd1ff127ac26e9c
  • SSDEEP 49152:AWy9TOgsK67pikSU7KUTc6alV9Chhj1eGuJ/N1MJs4Rl/aYC7oV+Ob5ofxG/hmjC:q9TOgsK6VfxXTQT0hBpudN2Js4Rl/aYJ
  • TLSH
    T11FE5D5911784AC727721AB9C923ADDF0D90A551325C6DF1230ACF2187B6CD1BA79CAF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2