Extracted

• • Target

    06614499.xls

  • Size

    170KB

  • MD5

    57b9f36b7ff2ff88c419d7b652108392

  • SHA1

    4c1868c6cdabb597ceb82f6230d8f6899ce2d50a

  • SHA256

    7131b82b77924238dc3a86aafb04c522513d4e0dbdf7d0dc2b620d9998a40940

  • SHA512

    89bf880f63e144452bb68a2108b7354f5eefd3edaee9694b84e71123d412aed7945e4134c1dbcf00b4adac391023f814c13ac9be183a6952fa4c135b3c33ac00

  • SSDEEP

    3072:YJkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAtXN2jlfsSipkwUmbL19Y4qUhh9xdZ+:5Z+RwPONXoRjDhIcp0fDlavx+W26nAtm

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2