Extracted

• • Target

    PAYMENT SLIP.xlam

  • Size

    620KB

  • MD5

    1805ca0be03ee0029d70f078082ba3b2

  • SHA1

    db2c53dea18e2b1467167e20c28071eba6daae54

  • SHA256

    ea3c83e211fd21cc03f677d595ad020c7f477a7125dee8dcbcb0ea1feceab3d3

  • SHA512

    987d4bdc7200a86bfa0c35be80f4b3271679ab24b55782cb5512159cfa89d7fe9f107136985c9d658bb07502a45b584fef4e06a0303b05dd6e42c021903d5e49

  • SSDEEP

    12288:L2nWLnaUJsX7dk0nY8qMQgk+e0TqxP8/7G6Z83dnQEaDiwH:y5SmdxnhqkNeeqxPS7GbMJ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2