Extracted

• • Target
    SecuriteInfo.com.Exploit.CVE-2018-0798.4.3965.30353.rtf
  • Size 76KB
  • SHA256 5a9523bba8e40c9d642fd99e046c4c06ddb7174cb26da584ccc0db4aea139f87
  • MD5 2fe0bbc968301dbf2a967662ff676fd1
  • SHA1 689f74547e3c6c3015a44d00d0a62c2ad2abfeb3
  • SHA512 d1d858d27524fa4849079a238c8351e58aa0440e9b0cb2507101faa19a160c0a49b27449355b7d371a403943153bfe4390e3cdc253560e5c0d732496aba01d80
  • SSDEEP 1536:lwAlRkwAlRkwAlRK3c3A8QhaeIOd32m3oR:lwAlawAlawAlNA8QhaeIOd328oR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2