Extracted

• • Target
    gloves design.xls
  • Size 192KB
  • SHA256 c37a1523c641b7d3570772d73004397efd07e5df4ee1e5ca2145664fc38f6ae4
  • MD5 5f1646715f9ea3a6bb2e472a9ffc05ab
  • SHA1 fe3ade8c3b3e43fad68bbdc83c3a9d91a020dbc4
  • SHA512 fddafc1280db573cc773a62f981eee6ccb6bf3184f7894b8c5d38bfb61d0266dcf8aeac6df5e48343f442a2ae4b3c48fc9a39350c752020b73c3271551e7e000
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggertrojanstealerspywareagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2