Extracted

• • Target

    Sy-Nel Order.xlam

  • Size

    700KB

  • MD5

    19161547cb1c2d2a21f69d62892b9411

  • SHA1

    9999dcc93dab8e3373646b68536664ae7096bd4d

  • SHA256

    166b56c5680d1a1d6af658167147ca5d44d1cd2df5772cae26d3d6051f8dbca7

  • SHA512

    f60b3c84c7037a52241ebf3dcb3828bd0e97b42bd6632352571a9348c50d703c12a6910837643866ef475de90e93441af69c9b47794efc421cf016646057409d

  • SSDEEP

    12288:ExnWUjSJeLg7XmKNBXwjTfaCoH6iSoJSAXw23AQE2PxinXYZ+ZzQUu6osD0ZmQ/h:eC0OVNBuTfaC4eAXPA3nI8zFu6oxYQgW

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2