Extracted

• • Target
    Notice Payment Direct Deposit at CitiBank N.A. Hong Kong.JS
  • Size 3.0MB
  • SHA256 fc48121d1c9668c5b6bb2df8cbc24564d39151bf032a585c15109266c8fc5549
  • MD5 ab076b8326314a0fe1228dc919b2b09d
  • SHA1 5d50e3cfa8291ecd815409b8f9e3bb9b848425b2
  • SHA512 149601a8ee4a3060aa8e2c358c332b6b3a3e35b9e2632d8626bab4853d0272b644b631aaff49bfc664e825c6a844602afd36b7987318022d8d0e50dc0359e47e
  • SSDEEP 49152:9izCvnqyPNwgnW5QlpeAGwOtlC3v3s+kxt5J61csdSX9gSaHyp4bYZ8Ko3dLi+Od:9izCvnqyPNwgnyoUAGwmlC3/HkxV6Aa6
  • TLSH
    T147E5AF751384D032732DAB4E96FB9930991A68631CC6DF3D30ACD20A761CD5BA758BF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2