Extracted

• • Target
    SOA DN SEPTEMBER 2026.JS.js
  • Size 3.0MB
  • SHA256 e54f05481cee213dbbe95548189ae2ddacc9c367bde451466f9dff7541eec2f5
  • MD5 60ef9d9ad17d71550324a67ffa65180e
  • SHA1 b2415441e25d69e99ee3d3b235d35fe89a45f6cb
  • SHA512 d7160abab4d71e4c3a8795ff076bfed001e31dc35d0d571d142fa2052a0f15c0db22cd53fa7c514dfb3544b8ce12acacafeddbe76a7a35d037897cb8e52fad25
  • SSDEEP 49152:PzoJgjtQNilmsJlFyJijXWououBV9dxgz6HMNDslsGH8sB71tRyHMDq0qPwQ2oh8:PzoJgjtQIlmwlFyJijXWfouBFxgz6HMO
  • TLSH
    T169E5A1B11744D032B72D679F92FBA920590AA8131CC6DB3D306CD219B61CD6BA71DBF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2