Extracted

• • Target
    OC-896756987565465.jse
  • Size 111.0MB
  • SHA256 72dcf5042bed9be0ac6fc2f96ad14365411a17229474bb4e493574613dd1f548
  • MD5 b34a4e7862b2a6474f2cfa4a5d7de389
  • SHA1 100e27d21b2a230a4c079dd6e0e608ebd6768918
  • SHA512 f59b4e3466cc6e124542c4421e4133a6012787e189508ddee73b46439033b3004bda168f08b5d508fcebaf4efca43d01889b2678f408b0fe8b6609933229a995
  • SSDEEP 48:pCDOkHGfQVa7NeoApWoeWEgUn/JdXJWAKJK368PmyKrnKKzOLGRqQaJTOqV2Fq:c6SMQmNrpoWg2/PYn8X6zeGRvLk2F
  • TLSH
    T1C048F08C6C89E024CD36F37DCB3BA51EE7576467050BC254B49E9B402F7181686ACEFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2