Extracted

• • Target
    Factura y lista de embalaje.js
  • Size 489KB
  • SHA256 fe148538fba22444ce8076cf7454ae8cae26265d711205e98dab9030037e9cab
  • MD5 5c9386b66b4a6c8e839693aafd77b62f
  • SHA1 392b1bd9af41c720de6e2481d0af291d47d0a9db
  • SHA512 5bf5d9b6c98c642916d437a4ac22a19db9ad20da0dfb8a42b4c3a58ae92e40513140ccf0272af1c4b8bc5870248636c51e0903590e36a9556309733e2a017aa1
  • SSDEEP 12288:gSEsSC8cRobqe6vRkNcrkBvPUUTj2pHTx2HF6njLMg3:gSh8cRffec8Uej2dT661
  • TLSH
    T1B8B4124377907D6103AD061C705FDF54A9EE167D0920FDCEAAA9E0F2094CBAB81B2D5E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executioncollectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2