Extracted

• • Target
    AL_FUTTAIM_Enquiry_List_no#1DSQV00013019.JS.js
  • Size 3.1MB
  • SHA256 936d67e1beb2c8637695b29215739ee522b3183041848a87e09335c674b57d1e
  • MD5 450452a16884cf2ee76c2b2e052f9f26
  • SHA1 70cc83380e9dc60e8a2a50622878b40b184b21ed
  • SHA512 126e6785965b60bf0915aa42737f91d9a70088a9f410af34ac414b06fa59ad7fc762c957132872e7a55ef0f63b40658226baecdcef337edaac936f12e9846b89
  • SSDEEP 98304:loD251ZAAVwHr0SetrVaYUSMrMWQD2HB7dtMsR6I7usuR5z+bh1dq3f1gPcoZ:q2fyAi0DNVaYUKR6BrR6fvzOh103f5oZ
  • TLSH
    T1AEE5D3411700A7766638B31EA133DA38A54A624395C8DF3D387D9305B758D2BA3DCEFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2