Extracted

Extracted

Extracted

• • Target
    Comprobante de pago BBVA.js
  • Size 312KB
  • SHA256 33d543386cfbc9f5d982ffe157ef2e5dfab16bcc7fd850894ddee4bb6beaa19a
  • MD5 988da4fc060341aa96be3c88b8cb2841
  • SHA1 3a8afcb53aef7561565388cb838a06fb64b51c0d
  • SHA512 cee9ed131437f07245ff2fafec7945b93e27872a458bab0b1c8b467683b1c4419328b1dd8b06641c8bf46012178141ba083c4aceba48d06b90904dd61fd80ca6
  • SSDEEP 768:t8SPTecU+/zv/kYiWEfeUAZJ/vNFGQc372AfkX/KXdQL1va:6c7b0YKFAZZvNFGQc37nkPogQ
  • TLSH
    T1D464AA8352A4784005BF125A9FF105C491EE1587A3C7A9B737ED6AC43BBBD20CB5AB70
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2