Extracted

• • Target
    Recibo de pagoUSD.xls
  • Size 166KB
  • SHA256 4c324015e50495b053576c0f1d691f5693d9ea18a33e9bf41d7c26f2101fe777
  • MD5 7e3bce38fd10db8e74125e4ddde576e5
  • SHA1 7f7b39d946a4cf12108a3842990dad23a39d7a0e
  • SHA512 4d8c8ade35d4037a7e8bfc7d321cac10cc380a8a48d48ddf788ed2170358e17988102ed46c95f02288ca6118f8f3d0a663b84012b4af098472ddbd1198247130
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2