Extracted

• • Target

    24c228df7c2e025c2db64ebdc6d5824425f3179f228145866bd55700cf7e05ac.xls

  • Size

    392KB

  • MD5

    1cd369286752c3d016b8ce3d59f43e66

  • SHA1

    ee6222b823a92cae26f04351509a1254556508c0

  • SHA256

    24c228df7c2e025c2db64ebdc6d5824425f3179f228145866bd55700cf7e05ac

  • SHA512

    9e875bf7a628faa32846a68d0f699601c31ac8fd66d906d8ba72b70d56ef4d376cb569c0afca1e5ba7eb8972df318d17cbb6393105a4e0c965d356350862b7b2

  • SSDEEP

    6144:un1m9kdb/Gt8b++UXaBkMOQGeg20HYacK4vPLJJhZrRIh1EBb:uOeLlS5aave4HtcK8A/EB

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2