Extracted

• • Target
    dyualhjp.JS
  • Size 3.7MB
  • SHA256 394143c94978553d11c57e3a6ed833bed3edfecdbf7f60ea4fc796b350758898
  • MD5 e9cb3bbdde1fb80b4a5621dabc5e1cd3
  • SHA1 4526ab22566d505b7ab18626b7f5d2b8e034c875
  • SHA512 c30e029e224ebd351b51b8e1ce474cd85150d5764b7703e7bc6d2b182b946e9bfba6796b45e6c943c4a62c586acea948c4b4cbfe9f44fe84c23d530c68e4fe90
  • SSDEEP 98304:tqvCUybX0IoY2F/JsAVPPM3hUFpCLC14kKhOoT9POJFYpP7KvcXBY:tqvCpcY2RJj1PMRJLC1HKhOgFcFYRKo2
  • TLSH
    T1D006B4861781E231AA24675CB776DC30B51A538728C5CB2B303DC60D7B3B99B636CAD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2