Extracted

Extracted

Extracted

• • Target
    PO 0044567.js
  • Size 1.2MB
  • SHA256 d478ce0f1dfabc910bf785490d577bc6c85cc47c6a35ccb9e5ca220f56914016
  • MD5 9738e17fdf18cb977fc06a4c38d559b9
  • SHA1 ccd57cd2f5776071fd1d1512cb9afd1da6058e92
  • SHA512 ac6534857e2a46e1a9a634916e9727a022e7666ef98f1b80c65de61c3ddc0812dbab0e0f9fe360b63799acac908fcff77a0c7faa7bd14cd1e3f2e5dcc94c052c
  • SSDEEP 192:VzqRnZkV97V4qZZInGZdZznzR3zcS3nVzH+QRQ+VmVEa12mRw1orzfrMznuDrgZL:Y7JaK0Y6j
  • TLSH
    T1DC45C38E9829407F91CE5126F8285AF5DE45BC8AC57A1FC0381CBD8E154C67CE2EEDB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2