Extracted

• • Target
    CONFIRMACION DE CUENTA BANCARIA.js
  • Size 85KB
  • SHA256 444dfc08f738d0b08462edfd79f4e6166db8bc7bf45e9509f1fb51ca9978cfd3
  • MD5 fe6ec3f7dd04076aaa5a2eebc429a2f0
  • SHA1 15f300cc22396c6306da5aa95d0e4158c11d4322
  • SHA512 e1461e5adae740898b375334c406feb73f55552b871968f028deac7c68991aab8abb9154b3f8aba3e329ff7d0468ec2f5d00622fbde6e6eb6db2b516114d2799
  • SSDEEP 1536:kMq7/HSKopk0V8PSp3ftbO8ClKYiJ1TyUlijTYXYVW:UbSKoZOalfpO9kvJ1yUgjTYXYc
  • TLSH
    T150832968D52A823A4F47779DF86505A8C1AC9360867218F4F5DE4B0E500ABECE33D77B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationcollectionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2