Extracted

• • Target
    HD RQT_SC-1013-02-.JS
  • Size 4.7MB
  • SHA256 a86f2464a365a3f2fa330d0d2af03e0b50fa8900f7f744949e76c29be5232d59
  • MD5 021d5f60e11be700da6d0664f87932c0
  • SHA1 8111ad53aa2aa617402b52b0ebb2a14bddf61899
  • SHA512 0d73c985bd5583dc502f8c5e912537705927a6bb500df937b3ad805ed7dcecd2f818001377261cc48aab9d1769ac46159379c889d1dee3e8885d20a8084cb982
  • SSDEEP 98304:4CbpZ8oMO8V/gs/c6SbeeHBKCjQYN4PC+LVnDyJKLIrs9XPXjGYWLbrJT:lb/8oMOKMDHBKCMYNoVnOJKIGwFT
  • TLSH
    T1AF36E89A1740D5B77265F76C863EDE24988A900323D5DF3430DCF22A7714E27A74EAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2