Extracted

• • Target
    Invoicing and duty documentation.JS
  • Size 5.0MB
  • SHA256 cd1dd29def010e31b77b16e87b15dee050698b607d6d89cc46c31f83b9e17679
  • MD5 d5871794e1f6799bd9e6af813ed6eedd
  • SHA1 91b6a1f7a8a195989a334523709ebff99fb4e3c5
  • SHA512 e1eaee592baa16213d06bf97a9cbfd4ea522e59f730987f2924438e58f9937e68ad54b3e145b10b572292bd323dda2fa4a9d1b54556195ed7f1cc2ad6fe84a81
  • SSDEEP 98304:lEenGQTd+LqfTQOWkPZQOTGcBUtkgp/2K1KqK3fJiv4/0DIXI9ZMaKDenXUfbRlH:lln5Q2TpdxZ9BUtkgp/2K1KqK3fJiv4V
  • TLSH
    T17936DA90DE4499613AAFB31C922B6C22B04513437C83C615BBECE7342F2D95D9E68BF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2