Extracted

• • Target
    Inquiry for Best Price –CIF Offer for quantities required.JS
  • Size 6.7MB
  • SHA256 424d018ab6a6a797238043dec07779c728ab509db737e30d378db894f0639753
  • MD5 8e3fae064cc25b94652958da8413fa2d
  • SHA1 5aec5689d5019643c48a275e581394aa381f4ff1
  • SHA512 4b361efb927ef95a4963754fee830130ba07576de045101899271de6c96b351ce4c01df68ce6fd71ca1bb487b38b5b172d0165273d43447ea4db7f9267fba8f5
  • SSDEEP 196608:PxaDRJTH0tx3MfVjG3c1hZ+8NCBukvM7pd+HgRZlhcsg+vM7pd+HgRZlhcsgAxap:fcVj2yhZ+/8kvMld2gRdcOvMld2gRdc5
  • TLSH
    T1DA66C8425396A93FBA20579C43768D209D8BB00315F3CB65706DD1D4BB98E87B39CBE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2