Extracted

Extracted

• • Target

    PO#065.doc

  • Size

    315KB

  • MD5

    a5668dccaaaf2f7f6dcd64602b380363

  • SHA1

    5a0ec0e8546108ddba53a8ea8d593feca52c076c

  • SHA256

    9425175e94bf2958bec3bf42565ddb2a32263a20d56ae0afe6bc79238f57b678

  • SHA512

    b2ceffc33a57b98f0baf647f841ec5c1453444e20a690dae6a819421b515d3f15dfaab01d26a9a0104361d8c9e9c04996f3f1eeb25c98f900f4af06be1094bbf

  • SSDEEP

    6144:1/kNKK8pH+Guie918mj20i/k/knnyxChUS2YbxITUi5LSEXpa/5AB6Aqiu:VksTcjK0+nw6vtxITj++rB6Ag

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2