Extracted

Extracted

• • Target
    Minutes of Meeting.js
  • Size 130KB
  • SHA256 1df2bc819189c2acab962a4dbe0727b314b389c73841569a0cd54f0a969f5286
  • MD5 2a109619126569f001172da6adf79a6a
  • SHA1 43849177ac79cf2aaccf8042b05f347dc61c5f65
  • SHA512 c4cc64ae0a08c60ca4c24eac2664e598b9f74a0c3f0aadb9da8366bc4a8edd898b166f72efb319c729b54975e2a0b29bddf5e7dbb1fcdb2ec83ce7a859c2aa53
  • SSDEEP 3072:3xHxhbcVc8TPF7Y2homCdMSkPjRVc6KB5gppVJlPo9ZrbVlF+4YGOUy1EHliEUQN:sppaTyE
  • TLSH
    T12CD39C0126E18498B4F73E5295E710E90F67FAB3A139D94B56C8350D1FA78036CA37EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2