Extracted

• • Target

    8404d3dc32b0555bc3b076d7fc080d2a341508b4a2c84805a1d5ffc0057e2b39.doc

  • Size

    26KB

  • MD5

    9438b01f1e855f29eaf97344c263aa5e

  • SHA1

    271427843c271f7d0a0c4e69517bd39df9693b75

  • SHA256

    8404d3dc32b0555bc3b076d7fc080d2a341508b4a2c84805a1d5ffc0057e2b39

  • SHA512

    3222ecb01dfa57ee3901774a5b37fb4634418f2a72bd8447bee882e1594a45331de3669f7d06c9241b6e8293c7717c597fa6e4fe62a5e67e5fd76db13a35d609

  • SSDEEP

    384:FBL0AbZS3qC+L4desyxQbg01MYlCK7EWAHnUtqm3Gwa:FBwAbZS3qC12Qbg0jlCI5tR7a

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2