Extracted

• • Target

    ORDER ENQUIRY.doc

  • Size

    5KB

  • MD5

    f171857a9cc7939cc152f43316ee30d9

  • SHA1

    50a88884f5cae5469a6558e67fbf3bc12b473a5b

  • SHA256

    74a772134e325f53cb54809a228f2cf32763ecd6138d67160d9ab14f6e65ed4b

  • SHA512

    b4f6b2f8ba31a817ab502bc8332286fc0707ad94ffb254b5e2afdfe5f486fdf9285f33fdecbd9fb973faf4dfbf4ca565547503b8238dd3af4b1e3aa80ecb2216

  • SSDEEP

    96:AiAAwiD2riQQvYMM+nHkWQ8hS+FueiyMolGj1U:pAAwivQQv8W5S+Fue7MolGj1U

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2