Extracted

• • Target

    RFQ from GNQ(P12516) _21062.xlsx

  • Size

    369KB

  • MD5

    0ae14ec642b024074339270da16bbfdd

  • SHA1

    b220f12353df4e487af55e8d552d77d46f264760

  • SHA256

    93355cb08ff1efcf385845bfb2a410eef954da4d2d71a502e67158b33f95b1ba

  • SHA512

    76373e0e1ff00a7251082a58bc88a43a1f69a4a7d8d9619a347aef1437278db6fe3aa6b6f1b58b4390e9d23ce90a8bf6069f4411e4903f67a0a797acef3622eb

  Score

  10^/10

  agentteslakeyloggerspywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2