Extracted

• • Target
    Transfer_Receipt_Ref#3859695790.pdf.JS
  • Size 4.4MB
  • SHA256 ca2787f669fb4a6a91ce5705b998843ff7ca252a29bd1472ddcc2c9d4be97a2d
  • MD5 00575e176669c192e9e87f62be4b6ef4
  • SHA1 ef4ffbbda99d7c4b0ef99e8488c840009e14c11a
  • SHA512 d5022e0b260ac79fe0e74081e05630a385d04c7f608a9cd52605a57519940c7aa96db8dc4a9484089706f3151191953de37197d6c2aab8d9cf0341630b68ab88
  • SSDEEP 98304:nPOB3QW0PFb52rnvRUud7WBNoZmHc0u0bI1LiTq3HBfmCP1XGckdsfWreEzgGSrj:GBgW0PFb4rnvRuBuZ8kQBCPIckddreE+
  • TLSH
    T1072642492B4850B176BDB36C9177A831E90655930BC2FF03303C9A147BB9B0757AAEED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2