Extracted

• • Target
    startofflinejs.js
  • Size 407KB
  • SHA256 b23121b5f4f6b9e3ddefe7c9b991eb6351e7d048bbc8eebd7b215d8c08792952
  • MD5 cedc426b87ebb42f360ad92da5123b48
  • SHA1 02e46a48b71125d85fb1ae78202c9a8724f76d6e
  • SHA512 38ae6e43c1b96ea2fe77d3e621a2b9e6ef5b93531a2ebb98974eb1ad22805d51628471e4f099a940798119358f67eb123933818c7e26af2d15e6f81efd3a7a94
  • SSDEEP 12288:5pIXc4vq7ofmnCjY8pYQR52Ed7/OMQdL/fS:50cdEfmwYTQO/6
  • TLSH
    T16994011FDA06EE0B0960281B5F450D56762BA40793DDFA8235DC892CF7BDF6C913C26A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    startonlinejs.js
  • Size 84KB
  • SHA256 b48b2ea769e8c20756804cb3ddff8db12e232c1cda07356b2af27b9d3bfc7dc0
  • MD5 a60f36ce885436d478d1d71963991686
  • SHA1 fe129816cfd6f501e7a43a5e6b66a52a360fbf34
  • SHA512 2db371a960b5e3874c719ba19c359ca7e60b71bf65e83d71d24fb6a0e29d16a466d042d0e561d69f079403752a7fa419212bf762da9eaf9bffb1825baadb4855
  • SSDEEP 768:l6ul+k4HH2Hsg2L9A/c4THC8F9nSavDgKmjzbUG6WXWprJa1AEfVo7LcIzukbKp2:l6vn2MkfD8b2EKvhb3Zz/
  • TLSH
    T1B28362420A8679849337577B7B1A68E1FB770B6700850507B87C7454AFF2E1AEEE4CB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4