Extracted

• • Target

    SecuriteInfo.com.Exploit.MathType-Obfs.Gen.12129.3733.xlsx

  • Size

    267KB

  • MD5

    6071443d52fc119af0d876a05c83dbba

  • SHA1

    b97a01161c15e7462b13f5d65170c19984ecef0b

  • SHA256

    59c1ab21cdd58b8a8d9b4cdf0b8342a874863f16b5870e1db9dd2c1423e91aa8

  • SHA512

    132b1a493d4f6497f39d686a282aa97f355a6e4c181adf84d3d185530be961c402638d57164692c21c10ce6e415ece462ef33c1d4d33696ff84cbadae6673c91

  • SSDEEP

    6144:HZ+RwPONXoRjDhIcp0fDlavx+W26nAek0GHm4iiGIIPaT/:iHm4iVIIPW

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2