Extracted

• • Target

    Docs & Bl.xls

  • Size

    1.1MB

  • MD5

    8c6c7585d5657a10204dee25dfc16961

  • SHA1

    c65bd2e6730f0e508e8ea0cd02c22cdd713c98a9

  • SHA256

    d02df95ca48a3149b722cf65d7a0f8391aabd2230ad53dbecbf46809262f8b8b

  • SHA512

    354e717d1ee6e250010d954aedc618c43d93627397656be25ef5bff36a6035f5cc6c4d3adfe5e0ee62b512a95c16bf8e6309f4d64e948cd685fd09af65950c87

  • SSDEEP

    24576:LWQmmav30xSZy6w6VH6NvBZyew6VM6NmEa5SdQ0TIx5Dfaw0A:qQmmQ306+6VaBK6VNRVd7TCDSH

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2