Extracted

• • Target
    PAYMENT SWIFT SOA OF AUG+SEP.JS
  • Size 3.3MB
  • SHA256 64b2e057c20d888bb7e37dfcdc693a0997136cf9c65c20aa27e06e07cbf6f7ed
  • MD5 c2d59bd6d06f02e2da2239cadf2b90c3
  • SHA1 0af993fac6dc9bb0235f793fd56d28b19eec0b24
  • SHA512 99a74c9c7a9d25d6b36a404a387ff6d2112c75b7f19335ea1ba7476bbfec4fa690de591635759075c65645f1b102098da01dbcfeb6be2127c793b0a4331cdc9d
  • SSDEEP 98304:LyYiSQIBt/Kx6oTM0Me5RplfuM3k24979UZ5lQ/rZSMzUOEY:GYgw/1oYGRa79UZ5lQ/1ZzUOEY
  • TLSH
    T13EF5B609F23C97746A3E5F1FD43A79B00E0965133289BFBD35F47654B292626138E8E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2