Extracted

• • Target
    Comprobante de Pago.JS.js
  • Size 3.2MB
  • SHA256 60eb554685327afaea557949b5fd53ec4195ac122abda264d141dad22f5f3c8b
  • MD5 32450de290d4dac211d6e2e986002d12
  • SHA1 a670751c6c27834e9ac2bbf0e3842ca57bba841e
  • SHA512 00ac36b20f130fe4297746106fa09b4a733df3a259e81565f60c55c5d31f396f4d9d12050ece6d6786f317061792c89fb236b5df99fee3e1f148cea1f41cf6d4
  • SSDEEP 98304:Tc0PFYp3BIDcMyidHTTOhvfB3/hPS9ywGG4LrfmoOMZYTo:TcSYYdHTT8vZvgv0f8MZYk
  • TLSH
    T18BF59D081A70E2C724F8CBA6C40FBFF62B5E586BAE30CE00761EDA5D8949F463754597
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2