Extracted

Extracted

• • Target

    Orden Roch-CVE6422-TVOP.xlam

  • Size

    666KB

  • MD5

    5edda4e170c74a69835e8bd822c51803

  • SHA1

    daf25f4e5eff37fe7677ce3139b0042a3ec5e236

  • SHA256

    0b8fa64ce20b4cedd71c6e36261052f0ac8948ea296c6ada5791c90d563c7e6a

  • SHA512

    b254db2d0d3c23490334df11c368d3bf6c8b4647bd1c4ea5e413bef5e8d9e6aa6cb2b936bb59b85b3767d9630fed389edc30ed2b5bfc13402b22b6f0a1587fe8

  • SSDEEP

    12288:WTaUMotvoZmtEEPnBu4fYbHI4LXP+FEXpH1YUyKgOm9oQbvs6:/UNEsnBu4fgIm+FiVYUyKgl9oQTN

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3