Extracted

• • Target
    Realice el pago total según lo adjunto.js
  • Size 496KB
  • SHA256 5868d4ab68bec3677385fd0e9b60b2f1b0b6f1cb0e48ecd9a659770467435d0e
  • MD5 a3b649bb151be8e9b2a1db576fa62388
  • SHA1 f58adf9b09ea9d617795f1f2668db2ae303103c1
  • SHA512 4ac998c13ce6f6d59587c730903d46edad7a996a20ee54c42e449b0b85b2bf6820669ebdbd1b09a53f54eb9c14acad052bf4bd091b274982c494d91767d1cbbe
  • SSDEEP 12288:R1wEKDJE4yjaIDE7iuKx91oJrWTrVt1EAQLxZrogVGwqqy:RuEITWzyr6Vt1dEMgVGwq
  • TLSH
    T192B4121227D9783207D8FA3D849DCB0B8AEA0CD54A3DE6FE9940E5C759817958A3BD0C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executioncollectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2