Extracted

• • Target

    Shipping Documents.xlsx

  • Size

    296KB

  • MD5

    ae884ec9f42ceb1dcdef6cf4f93cce9c

  • SHA1

    6226ec516e17485b6b0e199e1a7661f56c4903c2

  • SHA256

    997ce8372e3dca365258dd1643f2de015d105205cae9b83a49507dc0281fb48e

  • SHA512

    08e27d46d0ae20a832b7a8a4a49c1179d4affeadbd32bb438854ddefa3800c531a6a2580477e9bc400e0f5477b551ffbdb8d15028fccd94a2016290f1e20090d

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2