Extracted

• • Target

    004530599.xls

  • Size

    157KB

  • MD5

    2afa5f8b900075c8275d482bd28d9f76

  • SHA1

    65ca143d36ccff4f1e1824b5f8e9f6c09d858dcf

  • SHA256

    015070adc48ca00eaa9fa61df9194059c1758c2502fdb0900bf686c8e3ddd6c7

  • SHA512

    e819b4408528d8dd21f9bdffba401d653fe46f455871a8a55fd22f53f64130039ce09407415336bf034c59a5106a000e2a49124b8ca12823431bb71b0edd8e86

  • SSDEEP

    3072:ifZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAM9Z6AFsTye:mZ+RwPONXoRjDhIcp0fDlavx+W26nAM8

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2