Extracted

• • Target
    Invoice.JS.js
  • Size 3.6MB
  • SHA256 b51905e75a4c231a1562e3654b855b18892bf47bb583c78a6b3442d82b152d45
  • MD5 7941e04e56e7c63a0b1470d81233ddcf
  • SHA1 ca36d7241f43ccedf37bf0e92e42c75d34be232f
  • SHA512 921b6f975bb4ae6a5b93ac413f70222476d80aa99b9d38403a0d2c1d11e60ce3062cc0bc907c9a07ea88f1f76a30801892897d2689c285de6757ef9dad5dd95f
  • SSDEEP 98304:0+g4n2nAKQ2uJM/vGiTYrFK+BwOuZ64MsNNrg2kP1M2:0+g49KpTyoOYhB5g28e2
  • TLSH
    T1370671C851BD582175AD631EC8B67A64732D930712C4DA3E307E4FA42BA1E1B1E8F5E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2