Extracted

• • Target

    MTE-QT-20231211105 xls.wsf

  • Size

    82KB

  • MD5

    36dfda4c860dfbd57b093ba713f02b95

  • SHA1

    fbe78a99a1d09521caf96e79affe068f8dfa8ad2

  • SHA256

    755d482683b5e165fae72bf4fc4d528f7c8cfada4e6b1aff7732a3f427f0ee13

  • SHA512

    6852606d27e6b77cf69eb709f3f7b108a25d8d7bb77c88c34e88303c0a411d118393a72d5de303e4e546cbfca1f21bdd04fc65089413881f2db58ed9a8f0f303

  • SSDEEP

    1536:cXL/J9xd6SgcIL8FJgV9faDdYG9zkEnSw3g/aq+BLmYe7293I:MrJ9xsncIAJG9fahYGJnpwCZx7ey93I

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2