Extracted

• • Target
    SWIFT Transaction #MT1038525849.JS.js
  • Size 6.7MB
  • SHA256 34a5d25011a84a18bab043fd3b81596fb4315f9e8fe1e40cb004341dab14ab3a
  • MD5 5cf4fd73b5747be8772a9725ffc5d169
  • SHA1 444ad863d8c14a425c41b4562afc0ccff2d4ca8e
  • SHA512 582f303c04456a90bbaf2a9212d7e82b02594675c9900cee89b1a921721ed75565478a35de927e39790950c1ecdff51424a8ca2452c3aa1aabec92149d1a7a69
  • SSDEEP 196608:RgCWW1dKqDDcCX9+PliMkzVYgKr4bvm9ddH4woBtnMp9FWiddH4woBtnMp9FWzgj:TOl1kzV7Zv2ddHEnMkiddHEnMk9Ol1kk
  • TLSH
    T17A66B4455746DB73B720B75C4A36B824E50E50A724C1CB2D70AED2243BECCB7635BAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2