Extracted

• • Target

    90971985 DRAFT.xlam

  • Size

    621KB

  • MD5

    81060ff4c39e6955c1e4523c759e90fa

  • SHA1

    d41c1eeb891774cce18ae03ab5d98a11d441c9c7

  • SHA256

    453a50aec0b029f077090b41b580119103542b9dae4db4331de2e766c9f5d0b1

  • SHA512

    68d92a9c9447801883eb0018723af590cb2ca315821a06c69c9d1198d399b539268e950c3a722f7159c61988d56f19513f2425cfa04e917505522e96ea726feb

  • SSDEEP

    12288:cRnWgCo5hmw9XyDld51WX3Wf0RHqLyPIP4uKYyuAP41QcevU:AFuld5g2f0JQM+lKo4mXOU

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2