Extracted

• • Target
    Curriculum Vitae-Asistente Contable.JS.js
  • Size 3.0MB
  • SHA256 0f7064769d4eaceb72957f13842ac87513943ca7eb1873796a21f3c1deb75995
  • MD5 e69d86bd88aa110d064fc50899d0caee
  • SHA1 4017f4df7b87d5345efd04f33ee11a2761bb3621
  • SHA512 d685bb7e2b32ccdf44f877718c0257721a1ada04affb138d06cc0f4639d43fe3197fda3ce3c8778e9dae63bc35b07de8f76e2097154ba786f74fd469a3e1fd42
  • SSDEEP 49152:PGwIW+eXgJr/qEegVuDerJnIgYXVuEGsUg3Xe+hvWoHVYqB+m4GQgDyPg2xseR9L:PGwIW+sgJr/qEegVuDerJnsXVuHs3XeR
  • TLSH
    T1E3E5E641F3F89B70AA2E5F2CD436AD5C0A5920076189FF3D3DB81644B392A17678D7E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2