Extracted

• • Target

    86c6b589396bd7069c39b4dc6578b1ad.rtf

  • Size

    45KB

  • MD5

    86c6b589396bd7069c39b4dc6578b1ad

  • SHA1

    f74ab2fadf5bd8b3ceed9cb2909f1920435d414f

  • SHA256

    314ebae4b7fc2a469b7de3aea6246db22cc31f2e7ee443b6126cee0b8a10566a

  • SHA512

    76a0f63f04f668f7a9d26389ec589bf7a9d28b55736839f7e26a2d4c4f69fd17c725f9baa749bee4dcee5dc46295086864cd0ccfb319c5cb421819a38fec839d

  • SSDEEP

    768:YFx0XaIsnPRIa4fwJMGlMZVCA5iZv+nbV9XdGSgudgutrbdYd2b+y:Yf0Xvx3EMGEiZ2bDMFudguNbdYde

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2