Extracted

• • Target
    RFQ_Best_Offer_Request.JS.js
  • Size 3.1MB
  • SHA256 22f66ced416455a603f6267fa6d299a3dd41497ad5a248b0fcb89b8a1af0298b
  • MD5 75cadd3e1a0b0054a359bc59339e214a
  • SHA1 c7938f5ea750a091883c68b2951b629265615990
  • SHA512 c6f9f250377d769de1f971a3e99b1bc5bfc47f9bf736969b00d988938b3df502fbe932ed857ed71dcd33787930b58dba8abfbd298036c986a85edfe53eb72335
  • SSDEEP 98304:IR/Wn62HHtjl9j/sWJw+wnA0yhVb2/cSUoj:2WnXntjavyhVCZ
  • TLSH
    T1CAE5F7418718EF70A9BD772DF1739A906A48614B618CEF3E34BC47447362917A78ECE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2