Extracted

• • Target

    aa800b27b3afb0ee91b9800f73a01a0c26156ee010032c8df84b415393804d14.xls

  • Size

    813KB

  • MD5

    5232ce0c0be5464c2b8798dec6189316

  • SHA1

    4a10e8fec837c4959cc01a97a83d1fe62e5a45c2

  • SHA256

    aa800b27b3afb0ee91b9800f73a01a0c26156ee010032c8df84b415393804d14

  • SHA512

    38503ea80fb508d58cb22301fb4780653feacd5fb6de78bba7cc7ecff1733843de81398240408281fa3a01fedad2d64c968e7169a8c75dbd8c0a8cbebbc775d8

  • SSDEEP

    24576:52Br5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXWmGr5XXXXXXXXXXXXUXXXXXXXSXXXO:15V

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2