Extracted

• • Target
    PO150726.JS
  • Size 3.0MB
  • SHA256 fa5b14b361b16713475e12678a236410660b1f814c5a408e606b9f382a48d861
  • MD5 7019ae456de7d3393396c6a7a5a632ff
  • SHA1 38f47a97b7a8899f4907dcd69f4de3fef50d5425
  • SHA512 f79e5dde06e9dbf7cdee3a0487673b688929d36e2e3aab2753c05591213f3c91a0bad432e5342ce125e42ebb5eec056b03099d3f8d0637ae98077ff68b58365f
  • SSDEEP 49152:s47PmANyYi/bOnHXLcZtGJ0qtHcWQzy+BxRLrny/JXYq4mH5Ydlh6H2tau1s4Rzt:s47PmANyYi/bOnHXLcZtGJ0qt8Wiy+BJ
  • TLSH
    T105E5F8710308E8B0A63E972FD0F7A5540A492D131E89EF3D31B81659779EA27674CBF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2