Extracted

• • Target
    Payment_advice.JS.js
  • Size 3.6MB
  • SHA256 0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33
  • MD5 bf473c73109d3e60cad6105499e0e0ff
  • SHA1 d81d5994e05e4c2d89a32adccf543f305f3ce7f6
  • SHA512 74c73b594160cbe8dc3fd2f8f0245cbe7edb38dec5d6834fbb4f111fbbdb36c2592635aa1711d0fa9abdbb75be94a4a7df305110aedac114f7bcc09ed25249c2
  • SSDEEP 49152:mpC1EsHgSJ/rSfLF8MI+1hHJcG7wnTqTuakMi:mpq1HgSJ/rsLFRI+jHJcTnTo8Mi
  • TLSH
    T1BE065E761604D920F56DB21CF1F6FA68731D122B1AAAAB1D317CD1062B72E122F78CF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2