Extracted

• • Target
    Comprobante de pago.JS.js
  • Size 3.4MB
  • SHA256 bb5fdae6b68a6a3ab2656726bbdd78ffdad3f8f22755cdcd6e9480e623158420
  • MD5 5e5a989bf3018d727601d98fe49d275e
  • SHA1 95f280bbd747c0b7153cef6856c6de3c05e3b942
  • SHA512 79b134da0d801ada3e7b809e095a45617c6c154fd12a840dbeb48026a23dacf8758781b0e63150ed3db65aefa49ce612b2dfed32d1e808eeecf67f074b9c5243
  • SSDEEP 98304:HyRi2d7PNgBDdhy5iSpAW29hPbOO1iPSGFXTRR1LC+ayp+/omZfryfl:AQhy5iSpA39hPiJPSsBu+Vl
  • TLSH
    T1C2F5E7300218DA70E66D5B2DE5697A18054C29CF51B9BF0D3ABE07B05376B3362BE7B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2