Extracted

• • Target
    comprobante_swift89534657687.js
  • Size 1KB
  • SHA256 41f76926477c7f8759900567ced4e5e1f9057e40d2a151badc873d23f372997e
  • MD5 63f6f06c380e5d1ce7325b504b5a27fc
  • SHA1 0a64b4f2424ada6c4b8efe421f78ab43f8372bf0
  • SHA512 f754559e8d797ade2f7c981a54346007978c27e7333349110fc3992911ac10b4654df1c42dcff13496e5094cb9eb51ede53535f3f6d4eab739ce130ed9fbfea3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2