Extracted

• • Target
    SOA UNITEX SHIPMENT IN OCT 2026.JS
  • Size 3.0MB
  • SHA256 3399041a0e91236df7d79d103561455d71874f1aa656e6a7a5246e3b8e820135
  • MD5 2173ca23ace2f70d0f9fd031870095a3
  • SHA1 51129dc647f474ec54495c4b34b535cf0e0acac3
  • SHA512 4c0f79250763301e6d0bb7ed88591134729045c46defd8947a5ca3758e13431ee4c26bf889a1ba3c5829ce1cbd3c7d498b59601ace8db741040ad5d5628d0753
  • SSDEEP 49152:/J5W/o+zy/yAR3l8fakDzi6NPiJkZh2p0QdomGz67nzdW8QsUtqiICIWgnHIC83r:/J5W/oky/yAR3l8fakDziaWkZh2p0QdM
  • TLSH
    T12AE5A1711344E172B72CAB4E96F7DA30990A6A131DD6DB3C30ADD218761CD2B6718BF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2