Extracted

• • Target

    PO-2100193237.xls

  • Size

    145KB

  • MD5

    75f03b0cdd937e55de5cb442cf32d995

  • SHA1

    6adaca4eff6ac6b02447fed5edc8ece74dc5ced0

  • SHA256

    294739cff953bbd4cb90ba91ffc7faf7c169875818c54d5379de317faec5317f

  • SHA512

    142e57ff5f7503cf18bd7756bf222478fb47c1bec71eb01e24d0ec996b0fd82f4e8f9315d445b91c492a5078134a0b028d9a16f3f659331d7bd8c20430b9ae60

  • SSDEEP

    3072:5XI8BEE2VI8wnSDMidLUiD7oB4YxM+kPB0Enr+K1ciO:5Xf4V2nhWL9DoxMBqqr+sciO

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2