Extracted

• • Target
    Purchase_Order.pdf.JS.js
  • Size 4.4MB
  • SHA256 b7e491965b690922fb184ce43e3ce425a4bbe6750efe01d764f71e24bca4d7a5
  • MD5 280cb77f19056b00026dcb36eac982ca
  • SHA1 68fc3cd4b92b4f101cdc030445976388d0d0d047
  • SHA512 4002862cbfc68cfeceaad89f7a547ec8b41b37f7a81dd2bf33ffadc15525fd88dbf5f6e60fb8966d2fa7781660ab4d6f3f7bc1b40ee7f72a944485e318681cf1
  • SSDEEP 98304:XMB4rI4RZixR4gHWAYymVlxzEyirNL6JeTTeM4zrncrrUlSSZtHa1VB2nIRr+Xta:XMB4rI4RZixR4ZAtmHx4yihweTer4rOe
  • TLSH
    T1F0263CA51744E8B177A57BEC59B69CB8D60B10E391C2EF16303C6100BB76C8F9758BE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2