Extracted

Extracted

• • Target

    FACTURA Y DATOS BANCARIOS.xlsx

  • Size

    855KB

  • MD5

    47bd19f558a74fc037bcf111c5dd387f

  • SHA1

    b7e2c5f0e8d6a898148f338ac626e924e74f437c

  • SHA256

    71a0ef3bd50d79be4102f44b986804201125803c2476b37635687990b07b092b

  • SHA512

    04bb74797a32d3ad112d91c2b36764f3ba861c6197deb49657e9488b64ac22897523146a248772154bbc9eb36ca9f3a909a1fe0e56b07ec5cd8a17eb976aaa58

  • SSDEEP

    12288:zML7nvXmvC+J2C5jmeva+JB9GL7OnzZXppEiCS/e3PDKxIY+nwHGNFNXGb8LvNMH:amvCEV1vTvKin3yd0/kxPS8hMOK85MF

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2