Extracted

• • Target
    SOA.JS.js
  • Size 5.0MB
  • SHA256 f94ff18d54c1406d8d0401ade28a5135fffbaa986f824843fc145d0f46acabac
  • MD5 f7485d99c6f490f96f2b33213eaebe81
  • SHA1 61f207844adc87b5e81beebcc15bfd4bfb0d9edc
  • SHA512 f068f20b417cfb4e3f85a6f02675dcbcd5cd8720237d29930f3e60760feb401fd936f6406df041f2bbd4fc98227bcd933d8dedc8ecaf821c7694031fe3b3aa96
  • SSDEEP 98304:v/HShISFaH7WlmLURVIOZlwtJfi8XcnkyvbqBviwZlPgfxZ+cILfHWOtLnFKa7ED:XLSoqlBR5u7fi8XckyvbqBawZlPgfxZt
  • TLSH
    T19236AA4037C69BA2EE61535E62368832D60D5EF31589FF2D336CF110BB2B94E12689DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2