Extracted

• • Target
    Curriculum Vitae.JS.js
  • Size 2.9MB
  • SHA256 fe9ce873465f2fb565ba931e3755c5d7f4714e5c43d43a50703b7012f4718cdf
  • MD5 0e7e9912b51df784f049b257fd4f7ae1
  • SHA1 9bd9a19938f434b4f42229cf96899814a82c5871
  • SHA512 b803807e3412e3b4aee00ec51a7fe6fbbfabc31683e1c92799cfd94b9244c4e0582e6a6b4b744189b1bc60c036db334c023d91d54a118b388bd01aacfe4939e4
  • SSDEEP 49152:O2kxixJ+9L6G7cXWbXup7GPCC+C86gGoEN9ncvnXaFOVpVAMY38RaUNkPNd3aMC0:O2kxixJ+96G7cXgXup7GPCC+C86gGoQZ
  • TLSH
    T17AD53B614E1CA970FA7EE72CD436AA60CE5D30175199FF2E36B8164873A2713275C8E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2