Extracted

• • Target
    Estado de cuenta de reembolso de pago.JS.js
  • Size 3.2MB
  • SHA256 b89249511d088ee5c90345689d4c8a85056a319a3bbf56c0394a4adaf0545147
  • MD5 ffff29eeb5fbb6f2a9a99efdd513eb99
  • SHA1 9adeb1acb6bc2b0b159d73b316f949feb216865c
  • SHA512 139dbb5a2a23f8289b64cda456641b27cc6dbf05d22c19065863b5f2039fa3510674f86a317ceedf38758d5efd1a2069c0d87e76a0c68bd4869ae25d28cfb6b5
  • SSDEEP 98304:Mg5nNx08faFTtIS7MFo+vHq/Y416FVOag7PaAvpLt+u5H7JOFqAkB:Mg3xLfqIS7oBjXfg7CWpF7cFmB
  • TLSH
    T1CAF5179167A0E1377720E79D953BEF30980F641328DACF11301EE218791DD9BA399AE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2