Extracted

• • Target
    New Order.JS.js
  • Size 3.6MB
  • SHA256 90359d39d32477ce3168512a340225e1737a810b21e308ffd312680bb3811c5a
  • MD5 d994fe0aa92f751d89e9a0b889f760c0
  • SHA1 a2b61b58fd1c47be8903167a04ffbfc6ecadbb42
  • SHA512 f779ff4b1efd5433aef7dfac8ea1a77433d2defabb5cf8940b6e0432008c4286ea75e31be398fc5d2b979ec5bec0a229ba7df58ff6dfc0eebca12678c4cf89a0
  • SSDEEP 98304:2joGhLcy2Mq+UnqUTKtbDm+PC02mJwmJIyMSNY:sfFFLRJwMHNY
  • TLSH
    T18C06B4C472945570A9BE7B2EC2276750E3AD120F1144AF2D72BC7214EBF3E1A1A5C4EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2