Extracted

• • Target
    Products, Samples and Specifications.JS
  • Size 3.7MB
  • SHA256 8e0bdb9bd244d4e8518cd1621df6eb369fe83bfbaa43061e563ec6b5dad1997e
  • MD5 634595253198b0b486a9bfa6d7aa7a6b
  • SHA1 9712ba8a86569df37714d42467403239eb307060
  • SHA512 a070481a04ec82b3283a6b742ff97252f490a2155536f81dbba88830c70858366f9a60116b1a70b4c920f7640c19d519ea17a5311083a6fb2b70e12b600af5fb
  • SSDEEP 98304:dOx5FRDLtR2C9nI/9RPnhBhilyOch/b0Xz9/cSRAm2TOfDRTp+PgFOQUpd:oFtP2jnhyZqAj9/NRBLX+4cP
  • TLSH
    T1E406B6409608F730A97DAB2CF6765538660D139F25C8DF2D307D8208BB7369767AC8E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2