Extracted

• • Target

    PO-BCF220340.doc

  • Size

    28KB

  • MD5

    532676a539f1be2b2b5132724a593f3d

  • SHA1

    3b5c05bcd36be469400aaf08e84cf959b02c10bf

  • SHA256

    72741fbda226683f04a4966fe43d16d963aa22991521c27212db349b8cef3362

  • SHA512

    1ab8e7e85a399b19965528dbca1a5d91cab50a8cf6632bf4aa3bf9ba6970b001f953c1186c4e0bca95e6fa072ab0e389b05485746e2ab521cfd8304723812821

  • SSDEEP

    768:wFx0XaIsnPRIa4fwJMADBOxM7WdcLCCiYrUD:wf0Xvx3EMADBO1cSYs

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2