Extracted

• • Target

    SCAN COPY FOR 73540145_1.xls

  • Size

    246KB

  • MD5

    96381e13b2a80b4ae71c632d059c9f12

  • SHA1

    0aba523c5aede2dce0ba444a9e294e10affa2786

  • SHA256

    78135a0e18d31257559a71cb6f67a7d90495bcb2ef45ebe01b7bc1718a2ae7ee

  • SHA512

    58b08915ba909d46fcc13d2f0e23e2c1b9f5f7e268a112f6c953c904e4a7af6faa378f976822db5650515555627330b8613475b6fd4ba129ffd1567ff94b495a

  • SSDEEP

    6144:oWZ+RwPONXoRjDhIcp0fDlavx+W26nARyWP:o

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2