Extracted

Extracted

• • Target
    CHARGED Electric Magazine Estimate # IO 4495-24-01.js
  • Size 5.8MB
  • SHA256 3c317b9902e36da77a1d3850e2e8074b82ed965e8443e46e41d5d65fe0832c3f
  • MD5 7e4d0baac70997dacc00713bd588056e
  • SHA1 4444e325781d071df34f3b69e5d5826a29f8b783
  • SHA512 8a2249bf2a44c3cafb23009eb2564e1049347b1c356f61a248cc2675f647d31cf517d51e36851cfc21f7c563eb2a9155be52d7220eefb0228e3adf0480aa7d42
  • SSDEEP 768:SLEkUUwUUUU4UUUUuuxUUl2UUUUUUUUUkUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUJ:Td2ZHo
  • TLSH
    T15E565A9E301B4B59AEE6096DA67DB5163B512C253D1CE00CCB27DE0FCB92A4E4C9DB43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2