Extracted

• • Target
    MIC Taiwan RFQ.doc
  • Size 1.7MB
  • SHA256 ede0c266836e85d1ac3bc623377fda09bb0135a9746a0ecde6d7c52c7eddfc24
  • MD5 50fae186ae94fbff80dd36aa7b1f4ccb
  • SHA1 124e3f817e12c6ac42e5a4185f75fb5d62bc9513
  • SHA512 2132e6ee98d06084a03d9ffe66667e52122475f0e95edbadbb9acef1e8f706e4e8db344b8d6267c01f83724686a4a8387c8555d9cd4f8ed1d4b2bc200609af97
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2