Extracted

Extracted

• • Target
    PO6567800079900.doc
  • Size 147KB
  • SHA256 851468fddedf53fe23dfc8cbc568741692e8a6f0677069f1d07a3a0d185e08a2
  • MD5 92adec37c820f48c81b8e9bb4a56fe5a
  • SHA1 cf9c014b0854358de3800014bf3cfe3de9dce66a
  • SHA512 1b0359cb1d8dead37975891cd502ed83f04d3d4e74e561f012b0d27c62531893e56b578059c25fcaa2c045f2d5ac1ce399191ac6d3f51ecaf5dbd04572c07185
  • SSDEEP 768:LwAbZSibMX9gRWjtwAbZSibMX9gRWjGw093xS7lKPnXHaWayaAVBtTSCkMtu3gz:LwAlRkwAlRnW7lGX6WayaoTUMtuwz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2