Extracted

• • Target

    SecuriteInfo.com.Exploit.MathType-Obfs.Gen.12640.22160.xlsx

  • Size

    189KB

  • MD5

    029093ddb07252a67105e7f9e1298e74

  • SHA1

    33fd48b9dda45baaa1c5ec27d1ff82809ffad4ec

  • SHA256

    d0cc1ecb03997d41886914f7c78052b52d48c571067e016c8133afa158885350

  • SHA512

    7ea8e5ad8d2b226b92d3e5834a83445295163ba3fdd07a9de0be1698007a2c09766cc1d895bcdab9b837c36d75600189b034904ccd051f43c777c1db1bfcb59b

  • SSDEEP

    3072:ykZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAltqkKSACAFBN2Mw9:PZ+RwPONXoRjDhIcp0fDlavx+W26nANR

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2