Extracted

• • Target
    RFQ LIST.JS.js
  • Size 4.9MB
  • SHA256 a340ead3b283edfc401a385156d231675a67e092fb3c77cd2fcaae3a0376027f
  • MD5 9a28c9f6f9d19268679c4998bcc175a0
  • SHA1 7682a372731212b52282c74ea03be67192bac270
  • SHA512 ed5eb4cea27b4d12974f15d84cbd3e1d94e475ebc74ed84de9c8280b3df4437ca5e6362a4cb968009651ad50453bbc51e22b76d9babb2df28e5c73335c3a7101
  • SSDEEP 98304:fl9O4KImraeQickZA93zpYJctjJZ8tmH2CYryOE4NboZ8hK7IwJSXPvIcjfm9gyE:fl9xKImraeQicaA93zpYJctdmtmH2CY5
  • TLSH
    T189363FCB23A5613233B1575DC73AA8709537A4CBA1A5CF20369CF3157EAE907530EAD2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2