Extracted

• • Target

    September New Order,xlsx.exe

  • Size

    380KB

  • MD5

    866ba31a5870b2c4e0466f5b3acc031d

  • SHA1

    7dcd9d6602567b05a584adfff1ee16cede60ce39

  • SHA256

    c9ace3dfb99a1d0a1db8d53c9a4648d4021c594d160101112862c0ea7f4c8d96

  • SHA512

    ad06c69368bea049edbae3e822735c505820f61383238b1f0aa9762f464d09da1b9cb7da28a7854ef4524472264d33f6e1ff1feef66d9c740254051a97ddad18

  • SSDEEP

    6144:/Ya6JEIfgTqeDKfeFOVffuIUPKD3Bas8U/9vfBU8739y7clVLM4n:/Y7EIfgTRKPffIPKjBa3Y9fBvyiq2

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2