Extracted

• • Target
    Confirmed Order.JS
  • Size 3.6MB
  • SHA256 1c88e7b5bddb19df7666492d87ff21be450e43606e6ef8c21e198c4c619ee6e6
  • MD5 da46d735349dd23dc53ed35fcad08bcf
  • SHA1 a5177f0f4eff5f3fae14cb3d3831f68153e3fafd
  • SHA512 59a564570e0257da266701f57f45639790783d29eaf27881d107315040b8dc46fe2662a81d34971c2adf86771a33aacb12fe3c72da874e957a1ba43101531b83
  • SSDEEP 98304:NHnwdo1pZoEupltoqC05lwwYzkJUyFLzB4jNfrmCxiD/:tnwwb/urtHZFLzSRfbUL
  • TLSH
    T1F4067340620C5CBD777D739DC0A5B650B52D930720465EADB4BE33846B6BE922ACCAF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2