Extracted

• • Target

    Shipping Docs PO12399/Shipping Docs PO12399.xlsx.exe

  • Size

    440KB

  • MD5

    a11bfa3fee20595f6562c0b2eb07fe83

  • SHA1

    61dceafd6971eba650ebab7b8aa3f8ab42ade135

  • SHA256

    6f3f44cde64cfb8b414ce1b26816a0e78bc14e90e2b5fee63991d9359122d481

  • SHA512

    c69113d36c9c95f3550fd6ffade2df958aa332a910b827a559257ed7e6b52e62fa7852073c21108bda37cb7c063edae9debe4e9514394b7f6d8c7b7b5029ed6a

  • SSDEEP

    12288:BXmWAakvgHhyXkv0xIYjbZcn4M79pkbzmKaukoki/:BXGYkUMx7VM4M79LiP/

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2