Extracted

• • Target
    FORMULARIO20DE20PAGO20BANCARIO.js
  • Size 109KB
  • SHA256 e742839692e1939d03eeefd01b88e6ff8088b17d6dcd9658c658851c7168003c
  • MD5 ae283817e38acd090acc7f0b59d40104
  • SHA1 76bc8fc184c52ba416a9601fbdb1db59e1b34c01
  • SHA512 e78f352247b1a3514f59015e005c524abcc3fd09122659fa5638005518cabfda5adc88868f732e7475f65d9589b520a4e125ce14d956069155729d51e6d9a1b8
  • SSDEEP 3072:HzaZRVx2yEObopPbU1ri3JHCGvr//KOWZMbU:WP2lDUkJHCGOLEU
  • TLSH
    T1C3B34960DD2216770F836B98BC794670C7AC930585720AB4F9DE870DA509CECF77CA6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverydownloaderexecutionagentteslaguloaderkeyloggerprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2