Extracted

• • Target
    givingbesthingsforbetterforme.hta
  • Size 14KB
  • SHA256 1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381
  • MD5 77db8fd951b0c374a307cd6de691ebd5
  • SHA1 3e2d4749892494ce8b634e4f9f2cdd165ab51f37
  • SHA512 bd6249b9eb92eaf49a926178765fd35fc0fb03ce83d5df4407e3be3da83dae040d02aade47bae43d35c0dfc8339ab8ca4bb6ccf047e176f4a459ab3ee7274320
  • SSDEEP 48:3Qi1C4/3ii14R4/3PHqrcuuuuuuuuuscFC0uuL6grwtX1amuuuuuFuuuM0VLi1ti:AaziajirycFCqwaeLaRag0Yaw+
  • TLSH
    T1FA62633D4B34E8C540BAB1BCA4A01C1331C0DA3F85349C05FC2C593387A2ACE9E29599
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2