Extracted

• • Target
    Factura pendiente.JS
  • Size 3.2MB
  • SHA256 b15494c671395c45978800229a26fbfcb1af47337974e120e6885cab21b6578c
  • MD5 e12a3fe0030d91570c651c4615899962
  • SHA1 8d551498a35bdcdf33a4bfa39de67db3d12b172b
  • SHA512 b3a7c43c778223a2ab37e0611b4c3f19d54e626959ada072555b9f0a21b8667a2e351fe78b08b029806719ab0eae763e309bf31df9d6c4de36f09c3b1d5882e0
  • SSDEEP 98304:+JjypPlfi57SKH37aZGHLVs8lGJxdYjMhS+Hhq/gpA6EbihpTYrSuA2my:+JjypPtiNSKHraQrVRUx1latWfTMR/
  • TLSH
    T162F5C3A22F97A13277606B8C4636E931941AE01314F6DF34387DD21B366CD07A35FAE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2