Extracted

Extracted

• • Target
    Final_invoices_20251027.js
  • Size 85KB
  • SHA256 cf197f7debdf926745a1170f38bb28c9e8db7fdf8638bfc13e148d494de9c96a
  • MD5 9708a4c5cccf0d643cb20ef9614708c9
  • SHA1 17dc81fea736dab26a130b10f90216bd1e896f89
  • SHA512 de516e94ecd48b007fdbc81ff9f64b23ff7ea8167853f5b9ddcc15948836bdda11c8619ee6f5ca82bb9ba55706059e7f20b5be51e125fa38680ecaafab84b006
  • SSDEEP 1536:SrVcQZIJSqOpZjV4qpe8IQqyR2h98L2KdepUAOUI0ujlZTugT5D:uZkSRPjV4/8IXTZsepUAOOuuO
  • TLSH
    T13C8338A0CA1544778B87AB9CACB94660C6ACC325C53305F0F9E9C70DA509DECE77C66B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationcollectionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2