Extracted

• • Target

    presupuesto.xlsx

  • Size

    343KB

  • MD5

    06ca1a5736b494936c1be9d3855a7c3d

  • SHA1

    6337e0b8e7203e1fa3afd6fa0bc95028686797b4

  • SHA256

    d240fe59e56ffa5d4a0f46043b6661f4842fccfc284e6b4d12ff59de67b3a162

  • SHA512

    a5113cd1aba3dab0ade550a45a32439095958d62cacc82ca457b0c4b4f84cb789f2c2e8564214239f49b6cd3cc62d4f757882c73d2710ce7aaa8a9cc3bc91237

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2