Extracted

• • Target

    910585dc854d7d426da46658ef550dd9c3f2303777d94193a8e765a5f711d9ca.doc

  • Size

    72KB

  • MD5

    3759689edfb57ad919ccef034d098474

  • SHA1

    5c46f544dbe6d9d169b62e5ff3e473887c495810

  • SHA256

    910585dc854d7d426da46658ef550dd9c3f2303777d94193a8e765a5f711d9ca

  • SHA512

    2efa5b32fc72715d7945bdaf9fcf7c57d1460c1e6cf09b5d4b9928330adb52ea2c93af9d7709248163e4878ae71cf269170bd3d926c2d22efa3b47678f02ff27

  • SSDEEP

    768:rwAbZSibMX9gRWjjVwqWth+vVEUy4HFzAYYwCQbvGIl9IiMKpsg:rwAlR+VwhzQOUyMFzAPwmIlOapt

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2