Extracted

Extracted

• • Target
    20261027-000581.js
  • Size 86KB
  • SHA256 6c38ca8da245d3533d8a12f334da1d07a1a4299354b7b78ba376e3049ece916a
  • MD5 d0e28a4fcf074400c044fda01bff479a
  • SHA1 613a50e064ac5421dd8c01ae78afbfb3557d08c4
  • SHA512 da07981b2894fc387365663c283313cf8c4a7e204fe974e6b03fb4bbed35f4140f9f2a7a9f8a9bf01a1ec5662eb0ca1f2d999f14ba8bea3a0d64d48965325e24
  • SSDEEP 1536:Sr/giTi+mWOOvjVFo3e8I4StBMu9aL2ndehuUyvUQ3XjlB1y5z9fr:GTlm1ajVFT8IhMebde0UyvDXxkBfr
  • TLSH
    T1F98339A0CA1144778BC7AB9CACB94660C6ACC335C52745F0F9E9C70D94099ECEB7D26B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2