Extracted

• • Target
    COMMERCIAL INVOICE - PACKING LIST ___.JS
  • Size 3.6MB
  • SHA256 3c8cc58f6870f9163c98b39f8f7e273073c8326436d8df781b1345061ac6af18
  • MD5 d7d049d230e27221b3de0e7379dd48cf
  • SHA1 b1e287d9816cac629469a9dc2f0a90340ca0a874
  • SHA512 ee24b2f42e92913701aa9e567ad8d535d31fb122d1096aa04145d6efd87fc2bce152ddde3561cab9d1291a8e91e613b41011ae929c2daebb2a40c11587e12680
  • SSDEEP 98304:LKFhpRLMShmhrS2O/CsGMAHE592axlmkYTyjSw8gZyugnO8:eFhpWJMAHE5ZfmkYOjSngZy1O8
  • TLSH
    T182067F545144EA31B96DE23ECAB76F46373C928B839C695E377C01CC2B65B3311EA0E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2