Extracted

Extracted

• • Target

    NEW PRODUCT DETAILS.doc

  • Size

    241KB

  • MD5

    7098066eab8807aa361fa1f0fdff57ca

  • SHA1

    d6534ac36458aafd6b4b52e6716903786fb6241a

  • SHA256

    ce54e81125eb44ed53dec51f69f439d692ec3fcbfa99be82886163b5c869e74b

  • SHA512

    9381147f59475aaf7d7a5cb4cd94371c337b22c85eea643ad9483f49210efd313a2c503701d6fd980a56d00cc95a2922af99312116adee195f75d5ce1ce999e6

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2