Extracted

• • Target
    Nouvelle_commande _PDF.shtml(~99 KB).JS.js
  • Size 3.0MB
  • SHA256 368ae45a54fbe688349cb6ce2e43cb5c8ce3628ca5b0306b3e2daffb5e0ea76f
  • MD5 106e39cae6dcc9086c9484e26f176e48
  • SHA1 632ae8eec02d247397c731a106e2583cec1eff82
  • SHA512 4eebef74d44906b38916e85b4a8e84469fe66e3ba6d5d3480b262c86b0f23d79a4f1ff7485d895eee6bb1f88983547990ec1876001c17fecb9647b63ef9cb299
  • SSDEEP 49152:xLrNHl9jQGHohXwqiVZKEVVhDqC8QRvTWgPcAfnO90h0MzV2GJDiAgdx4ovoLo3G:xLrtl9jQGHohXwq2ZKEVVhDqjQRvTWgb
  • TLSH
    T196E5F54113449D32B62E671CD536A97C8D1A60C315CAEF3E306C97387619E2BAF5CBE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2