Extracted

• • Target
    QUOTATON.JS
  • Size 3.0MB
  • SHA256 af99a066e7b7408e1f8abd52e752ad1a43f1f4dab1b9b3c102b3eb6ae3a8c8bb
  • MD5 9ba9865c8ec39902968637b78f098ed2
  • SHA1 f9f0121507c67b07b8d3030a58373c24fd31c355
  • SHA512 9ddebabd48493d9725fa0434030cb077042fdee44fee6a67cd0475e8516afb343f432d4e36b03db50ce03a13d88ada9ff117ad3c6a0387bc03bd58efda0811af
  • SSDEEP 49152:puYlVBM4kqihwZAuH2n1hdhOhsi904Lkf0589Rna7OfMv8Hi/gs1FL0tvr6oWAGV:puYlVBM4kFhwZAg2n1hdhOhsi904LF59
  • TLSH
    T1A7E5F7710318D8B0A63E672FD0F7A9600A192C135D89EF3D31B81658779EA67674CBF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2