Extracted

• • Target
    Alloy - Parts inquiry.js
  • Size 22KB
  • SHA256 e0d9e6ca47b8deadfc974473021f87b0d494a5782d5983ea9df22f7364bb7beb
  • MD5 164a81393a777630699a363389150b27
  • SHA1 75be24b4b3315cd0059a406a7b295e99bfb1439c
  • SHA512 b36fc06989247d57de5b9c95c2459ba0d45118ba296092859e09c7f9c0de04f66a8c623182498593deeab75698b50559f74f87193863530dfe702c21787e2637
  • SSDEEP 384:KmkLrTFPhTnpivqVpuEZUzkv13nF1Yy1oaussjLPl38QH82LUDFivssRbrAahgRq:JkLrTxTsqVpuEyAv13nF1F1oaussjLPJ
  • TLSH
    T153B2DA0459927844533B7B7FA31EA9D4F7BA1A770184490BBA3C6450AFF2D09DDD0CBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2