Extracted

• • Target
    000183_004Sorters_BratneyCompaniesFeb2020.xlsm
  • Size 139KB
  • SHA256 1509ca07d232b2bb379cd9aa007112beae4ca6c88039906f4faa94b8e7ce47f3
  • MD5 352819fca33d80c85aa8a14f0d2b2e9d
  • SHA1 c87a76472062ed6f22896668d59c9c102728da87
  • SHA512 8a2cd1bf9f857aa956e7c93ad716a1b20a36b5d8513a66e0b130ac341983c43600b1c4542bfa2ca3aae1fbc3e5833f9b813211a334eb486eab75a0f94789d953
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggertrojanstealerspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2