Extracted

• • Target

    IMG_026_7990xlsx.exe

  • Size

    804KB

  • MD5

    75581f0ab61769efc27e279c0cf1ebe7

  • SHA1

    3d9c9d281df3cf8666828bdfa87a82297b8cf475

  • SHA256

    5658649d60ad2eb973e1c657001af54d8c1c927d0abada7a13b743a3c90ee6d9

  • SHA512

    b996ffe5134d4e474077f91233e45cd59caa2c7a3ffc70c170258bf114d9f4f90b0bfaa6e4aca6ed4e3641118053c3469bdcb911a2e04d6a8edda0d2a5965f22

  • SSDEEP

    12288:cOZwvkZUoqDK5vFY6bZ0bE2Pm29Ldm4R0DXzIyMif/XttiYe/HR:EkZUoczbTRNKXIyMI/Xnhe/HR

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2