Extracted

• • Target

    comprobante_swift0000099.xla

  • Size

    331KB

  • MD5

    c77bd22f2617ee0391d73bc33ba21c74

  • SHA1

    2119c4f53015751df47c3223c29a8afb68bb920e

  • SHA256

    45eaa51800a0b362be080b285afc6aaf1241c362685f3a76072450143074c59d

  • SHA512

    cd740279726c25ee8b96328f7b0faca2fb7f37f9e62f9fc97e15ed304f36e61a432dcae0649830b082a2048cc46a6526e3d13fa14ebfb722428abb9d6f303c23

  • SSDEEP

    6144:zrNzvCp4sJgadPGpDHBMixiMK6G+ZFrToQRZR3+v6oNkCgMCcJ7/:zrNbCfgaUpjpozwjTosrC6obC

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Abuses OpenXML format to download file from external location

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2