Extracted

Extracted

Extracted

• • Target
    PO# 4508555536.js
  • Size 823KB
  • SHA256 e46d75c20e44f9c494a6aefe6548d3c87dd44924397d52c480ac4f57fc5051cb
  • MD5 640656a7f18db2bf64db216b8efff72b
  • SHA1 7cda663ca5b58f8f7c812ece1486b074d1020572
  • SHA512 369846e3abfce56922f431c09940e69c78eef9ca7cbde9d3bce7cd1a45c8f3c73c94687794512632c5654c557be38f09e1a80975c4e24defac692d26c83c5769
  • SSDEEP 768:u4Cj8ufuY1u6590yQFbixK1/mFVADK1Bp1SAAs:uHOyQFixKIV1r
  • TLSH
    T14105C503AAA29D154F32559A5B98730BE0572A1F2125CBE5FBBC23900FFE54C731DB86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2