Extracted

• • Target
    Justificante Transferencia.JS
  • Size 3.5MB
  • SHA256 6eb392cb76c7c3882fd9d909e2d535377eeab7b928e3a87c403e737cc66b8f7a
  • MD5 2bab3100d7faa2cfab48d6bda6a8d366
  • SHA1 2b451ae41916bd7e79065c2d492443a0a650aadd
  • SHA512 13193583f3cf0b7478736d74369dccd2741ff71a4438e8ae2359be823bad5c47f7c70977fdb1470c395cb99c59c1cd2a9bbce901fd2340ce243a99221f9fd48c
  • SSDEEP 98304:PDgti0Q3FaAIhwZilgosUwhi8qpTq4mqS9jJyKFDm3SSh57l88ZbE0cFm0V4GFQZ:PDgti0sFa3hwZiGovwMqld8QDm5Fln5n
  • TLSH
    T12206F6B55754917B3722E3AE6239DE38904E521729E9CB0131CEFA34B92CD4BA3147E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2