Extracted

• • Target
    PO-000191 Shipment Swift.JS
  • Size 4.0MB
  • SHA256 b764f64137330577601a5f8c2bf82cb274c355797ca31a97a98d773bd9a77006
  • MD5 e4a0729cafa296bc40d34bd9ee10bec9
  • SHA1 87c313aa6591613ed534ded700403d8d4fb4f5f5
  • SHA512 a2a5659d57a2139dbd762801599e1e44afc9f8caf932368a79d0f3043e6800a7e54aa19b1cfecc55aaaff2b27513120f3f4cc13832d124722ed6357b7c76282a
  • SSDEEP 98304:T5Bwg+T1xhv9ZjQYVBeXlP/EeXb2iF7PwMEJC71bbCvEbBX4twTh35jHKO:lBwgO3hTaFdEkRbmIBomzWO
  • TLSH
    T1DF1664E0A3E9D53173E8577DA139C938D326198328D6CF073B2C8B147B5A987930E5DA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2