Extracted

• • Target

    Update Request-07-2023_xlsx.exe

  • Size

    632KB

  • MD5

    7ac0d905e8c2341221c95f501e7008db

  • SHA1

    9343ee8ea4115aaa8de1b64e3961a20482dcefb3

  • SHA256

    484794d12f8acdb2894d9009c17421bf0b5be491eb43273f35bdf56295b26ff0

  • SHA512

    c84b5a8616ff0dff7461ea21e4f3db1a68943ad675d5d769672241218c1d2d4652effd6177d7f0811fc1b51962005ed4386623e0db2880cb3fc1f63bc47d42d0

  • SSDEEP

    12288:QPYPfY7iag2Wuji8o5SoIGob5xSvETioMoB3dKjlvnuwwVV:QPYPgeagrueLZIlAETioxB3dKjlvnvw

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2