Extracted

• • Target

    Order Po.xls

  • Size

    1.0MB

  • MD5

    bf6599840c58c54dbca625ffb0ab7854

  • SHA1

    d2332cd5077c7d919a9eb70fd7ae5b52055fceb9

  • SHA256

    9a6a29e35db6e67dd531e8d1625beac0d1f83ab6694aa2a00d4759ad33e6d176

  • SHA512

    86095bce8c2b4858eb1773e36c5b8a47f632ca6186c0ca6404f8b1318fc3a9ca273a7033fe3a7a83a9f5eefb918ae4607ea1839e1d3e968e3a73a6c2ec74d471

  • SSDEEP

    24576:5RZyQw6VfZyuw6V4jKaWlEzp7a99dlzZbtQA3Qp5EfIwsx:5bQ6VRe6V4jKjOzYdHt/3XfIv

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2