Extracted

• • Target
    justificante de la transferencia.js
  • Size 46KB
  • SHA256 ae1436f0b4d9dff2c369262fedb409b397d66c71f0187474e24c45e9330da3ff
  • MD5 690b92d3eb9ce49c98b0ad218eed4a41
  • SHA1 fb1144df877c1ca1b087051509191cf8f54491c8
  • SHA512 e6ec8cfb8332e34c3be1ec6dc1594aad3fbadeb7cc253c7d29fb7ebc8ed4755ba28abfddbee6e6139965212a5e14666138fed64bc99ed640a2ad00e5da1a5fe1
  • SSDEEP 768:o4w5uog6hiXFl8ArP9FDTVFq+1eMCpoD/9Kb9YfFZp7r4u:o4w5umkWArP9BTVFq+1eMOKE9YfJ8u
  • TLSH
    T1E1236B90DD1B107A0F567B9C6CA80964CEA88215C433C070F6DED7195BC6ADCE7BC9AE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerprivilege_escalationspywarestealertrojandownloaderguloader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2