Extracted

Extracted

• • Target
    0dd2bc546cd4648d98c9d79e2e87810cb215bbff35b163edb71e75e10423cb4c.js
  • Size 85KB
  • SHA256 0dd2bc546cd4648d98c9d79e2e87810cb215bbff35b163edb71e75e10423cb4c
  • MD5 4c40e4c5767e353b93f8821282bdd3a3
  • SHA1 d3d0b1e10416b2dafe0c018e5713571e1c15c786
  • SHA512 d231041c9ee98c39a01793f032ecfba87e6bb502c1f520fbf89f372f3ef5dfed2c90253163c6a76de4cd331642542163abd0b1de0689431ea08fdd3ef9eb0738
  • SSDEEP 1536:SrKzZpI/sZObDjVFdQe8IBjcn59gL2mdeqmCULaVjlL/kvE:JpWsc3jVFH8IM7dQeqmCvVdmE
  • TLSH
    T1DF832860CA1144778F87BB9CACB94660C6ACC325842749F0F9E8CB0D9509DECE77D66B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerprivilege_escalationspywarestealertrojandownloaderguloader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2