Extracted

• • Target
    RFQ PZAO0112RF26.JS
  • Size 3.0MB
  • SHA256 ecb997f6d2856e7c5d699b9d6ef20e762d9841bbf06e058f0925efd457446b6d
  • MD5 52a11e7dba397baa22fb2e1e8da02152
  • SHA1 4b016807dfccb5acea7d5f79c8282491dc935df3
  • SHA512 a01481d2ad96fa1425e630fd4354a889cfe3e3da549ad313014798c7ea39991233ad7a518b85b96a074dabc4b7d82ae2deb8c0ee2413fdd9e5d50a2485869bdd
  • SSDEEP 49152:x8wXElm9METjoaVvP6vDIOLLwhvN1sFXwcSxac7jtNkrJrLvj2vKgyJJrvW5FHlN:x8wXElm9METjoaVvP6vDIOLLwxN1sFXe
  • TLSH
    T185E5E7711308D871AA3E972FD1F7A5600A492D131D89EF3D34B8165873AEA27674CBF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2