Extracted

• • Target

    BANK SWIFT.xls

  • Size

    169KB

  • MD5

    de538eed80d8fd3d08ca320457cc5fef

  • SHA1

    3880dcaebb4805aa968c118ceabc351d18ed27df

  • SHA256

    dc0b46a0add517f632937b605ff9d0820f8fefaf1e886c1ad3d0054d50a2a53e

  • SHA512

    1078f55767a5476f83ee529ae552a68c5fb71ed54258f13350304d795ca7f1127431fd66b283b3f5cafc5283371c8f2f3f37ac5844578ae8270574913cb66c93

  • SSDEEP

    3072:gkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAHeN2E:NZ+RwPONXoRjDhIcp0fDlavx+W26nAHc

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2