Extracted

• • Target
    FACTURA 0027560.JS.js
  • Size 3.2MB
  • SHA256 05c491f3252964d79d46b630f3a39478d2f530d513a7353371b6e40d5aba46a6
  • MD5 61a415f9d36dc6cd672cbf06560a24c2
  • SHA1 332da4f5cfa9fd073fc024049e60a11ab413c4ed
  • SHA512 cce2ed1e0f3d25c717426903475103b1581b866b06fdb10abdc81ba470274262791da13bf41a3daf435257fde86aadfe75489c4ff7178c35d17c7f0f83df85b5
  • SSDEEP 98304:3oqYFzHZOupBXO+ISnhl477uSQrWLH/YJBU+LQcZhuSS9rnHzMhtHo2:3s7ZOup8+IShS7uNG/YJBU+PZwSwrnHe
  • TLSH
    T1C6F518811790E1727721EBAD923BEE70A44F605314D9CF44301EE328BA6CD4B6799EE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2