Extracted

• • Target
    PURCHASE20ORDER20PDF..JS
  • Size 5.3MB
  • SHA256 eaa467e1483102f3198c2b3ec67e4429d6484c714b3f6e8ba6459ce34ad50ade
  • MD5 7beca5261c9bbd514ef1582ee6fad614
  • SHA1 74c416f1730b4d9c8df45b1be8674e49a75b78b6
  • SHA512 25553ebc269efa6cb97a316958e91fa731d0ce8fe3d6f46461aaa66b915a33891f31c99025099cc3a456cef69c42a7a5f4d3aa053a70897d84ee8026cb1d145a
  • SSDEEP 98304:WexT3QEkKQSFD/xb2Wrya0MzvNj1gXFsDzQLQcWDfVwLzhvOGEjfFnDvCQeHCqqo:BT3QEkFibfrya0kvNj1WYDJ2zhvOGEjs
  • TLSH
    T14446D4821364B3327779575C5A35DC28D5CBA1A318D5CF16326EE2187BACC1BA348AF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2