Extracted

• • Target
    PO-000191 Shipment Swift.JS.js
  • Size 4.0MB
  • SHA256 1f9eb3087aa6a443677d3ff0462809284b4b353c0a3884ac5e5e339a92fb7ea1
  • MD5 d3fb395f41ec65b46dc5d2f3e7370b64
  • SHA1 61f599816321b7bb500d42553ec02022f607f66a
  • SHA512 6848163ce66db8dd41a497462860ce67200a192178ee160183afe96429fba10020cbfc01371d8654cfc4914eebbd3bbf92a87610b685e3cb784c3b3c9a08176a
  • SSDEEP 98304:0t9x4PKJO9zO/fBy5ko+tvYykovo5I99miSX3qAakADIQDrBqEfdth6cfLEtLQ65:0t9x4PKQ9zi5y9+tvYykovo5IOznqAaO
  • TLSH
    T1201684C827436839B770F76D11B5B922B42D914312E1FF3DB82DC1183BAC9979B24AD9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2