Extracted

• • Target
    Justificante.js
  • Size 67KB
  • SHA256 3ebaaf5237ce37e7bddeb58adc5ad7761475ea52b6d75c71a3eb96a7fa203f17
  • MD5 cf956d6fbc8092c7e66cfd7d754cbf44
  • SHA1 ca0e5faedf1af720bbb8d9edae29c2123c481ddf
  • SHA512 18283f774dce5eae34807a845e63193e49d618051ae4974f0aada1a6e814755d6351bb4d15e7d2b73368729844c660c8759109c69cd5910b62b3f5ee17b77d21
  • SSDEEP 768:68axj+4q57g5ilW5Pe3SbjuBFGKpvSzS0S:6bxJ5P03SOB99WSR
  • TLSH
    T15A63319B06307E53B9FCE7C06959B7740ACB4B34A298627BD7E348BD9835C93F056424
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealeradwarepersistenceransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2