Extracted

• • Target
    JKTIN260000167 SOA.JS
  • Size 3.9MB
  • SHA256 9aab8281d2cf4f8405ce38d3965913065b15208b9fdabb43d16f70344221d237
  • MD5 f462270dd43a9c9f20dcf93f6eb21483
  • SHA1 6ad070226bd1ea067af941ea0a30542156007bbf
  • SHA512 a42414e2c54dce0a73955aff9f507dddbef53224a6e5b248342a7f0f00aa6f83bb23fd50c03bf952e71990f5d232b2fe49e0411c44c8470df3dc477bfa31f2e9
  • SSDEEP 98304:Y9aInejlIeD6rpKNbRYktNe8OhJa2RPJxxZK5tRoxAjvsm/bcMUTGScXsLUJTaTJ:KBrK6NgVYuoJLQ5oOzsSbcMUTgXDJTj0
  • TLSH
    T1FD16D25213876631372FCB5EC1369A21461E514B26D4EB3D32BCE34A727EA1B6F4C4E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2