Extracted

• • Target

    4fe755c27dc035254521204ace429e7d2229d51a503bba1678c035d0138cd406xlsx.xls

  • Size

    391KB

  • MD5

    5ea33b2a54dd29dc6d5a3b049dc8a2d1

  • SHA1

    5bc312ad946e5fe8258d6c4669b3fad66ae4fa3b

  • SHA256

    4fe755c27dc035254521204ace429e7d2229d51a503bba1678c035d0138cd406

  • SHA512

    2ca5a6b3792c9a70e8fc025c10a451a2972a9edc2869145d4a0a508fb4c8251c130d2f54fef11acf5c6f94de344782989055301b3c8dcbeaa43b9cd9e24cc32e

  • SSDEEP

    12288:+OeGxSqKjij4a3DjM/In2zyojn1v3UICbk:+OeGxBEezj8In5oD1v12

  Score

  10^/10

  agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2