Extracted

• • Target
    transferencia interbancaria (BBVA).js
  • Size 489KB
  • SHA256 35c66ce3e773fa40b9218d77f7713cdca9111907a94d762b8ea2857105dc7f00
  • MD5 d07d8fc399acaa4d794d3dd21ef77efb
  • SHA1 2c37950c36fa556d939901b6a3ead633e0ea0c8c
  • SHA512 c333204a1f13ee61e877a0967d1a2dc569865c38379b3fd47b4878b56a8acf0d7ba8dc0ba0bd9533b9d0ddb6349a183dbca6b24b373a24269fbf8487231bb35e
  • SSDEEP 12288:R0C5eUwXhVo88GLz6TMSIQwXCF5l1ApqFvqHcNiheDH4:R0s3wxVo88GLeTMSASXlmUvxky4
  • TLSH
    T1AAB412146BC4BA7E07AA4F2D446FE94F10CD26399509F4DFDE9DE9A8184EF8A407380D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executioncollectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2