Extracted

• • Target
    Statement Cargomind 2026-07-31.JS.js
  • Size 3.1MB
  • SHA256 58daf37444ec3b78fdea88dbf266ef70835de693c32a7dd22e911e259d4a1aa2
  • MD5 d0b88013e9668308dfc11b8ee3b1b04c
  • SHA1 375cbc6cbe0eeb57082fe3434cdfc61fe411114e
  • SHA512 ef53980710fb3a6301d33f47af826c3eb903458a966afc85491a0097e0e71df39b2870f38b92844ad9bd372d5d65da9e9f30de93d7cec961dd1c72b70a7efbe3
  • SSDEEP 98304:eP1oiH7pwEZjXvuAIsMEa7uNEbpOZnOskTw2FefBVr/gZtLM/n/c93mo8j:eP1oiH7pwEZzuArMJiNCOhODDezbgZaj
  • TLSH
    T154E5C74A9384923273A1574EA1B9DD30D42AD3C326C5CB11326DD51A3B3ED6B7B0CADB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2