Extracted

• • Target

    SecuriteInfo.com.Exploit.ShellCode.69.7870.25770.rtf

  • Size

    74KB

  • MD5

    25375705df41c56c40e056545ff3f4d9

  • SHA1

    8a2c0cd6307e0b60ac92bcce9ec9de0bf91e98fd

  • SHA256

    e2838cb88878911f84442041b0f01807d2fa0468a8f521ddf53dc1d578685126

  • SHA512

    23560663a0ec525a915bcbbd0544e549655de84fce4fca1272ea57dfe904d2a8a9befb35b3e750b232664f5aa2dee7dfb349268a4440f476c0495d8a7e0f7be7

  • SSDEEP

    1536:vLROkjy10yG0+Wm0x7mcLiqkep24scugrcfb0ogyi21mOlJWAL5WO4U6Rhq95kVF:vVtm0s+Wm0xNLiqkes4sXgrK09q1mOlc

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2