Extracted

• • Target
    SWIFT Transfer_103_TT_USD.26.08.2026.JS.js
  • Size 4.0MB
  • SHA256 bcfd3e59a8f8d4beccdf05bd2c8d4795b6b9f2f08af6cbbe704bc244779f5d1b
  • MD5 9ef0f837af8c3c91d8b028070ed0a9cd
  • SHA1 d162dc53d9246f85f9caf4c1ae512049f72d34db
  • SHA512 19dae44b22f11d238b3c39b184e318ff260e8f50bf220b95261cd4208148cdc1a23b0237d4a2b259e56e152240236dc77a616c9efe0a9c5b163747eaf31d5077
  • SSDEEP 98304:x8AGcLqdxN8JdS5Xp8ska+vhGXxlpsZkJ7F9ZcLthsSW23GV:x8AGcudxN8JdSlavhGvrShs62V
  • TLSH
    T15C169141836DD5323A236B5D52B68D22DD8D138B17C1DB2B303D8A1EBB7AD071748EE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2