Extracted

• • Target

    38ad73898e63618341258849243ad1ce0037e76cbe1bfcfabc40836618afc34d.rtf

  • Size

    62KB

  • MD5

    961469a7faca9a00f79a19c317969956

  • SHA1

    b303364caba3f3df9d0f51edc60a7fea724f005e

  • SHA256

    38ad73898e63618341258849243ad1ce0037e76cbe1bfcfabc40836618afc34d

  • SHA512

    9b99bdc81c104dd53abcf0ca33d44a37a1e59fbfd8ae0a2c6cb33b6d3f4f615c9a467b1aaf105f92765aa933b6ec97ae48c701fb9e87681bad4a0841aec69fe9

  • SSDEEP

    1536:8It84m/S+rUplDYKvxPZwwQ0D+xiDvTBOCFkxvG6M:tt84q0pYSxPZjjXvTBOWkxvDM

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Blocklisted process makes network request

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2