Extracted

• • Target

    36KV XLPE Materials-300mm.xlam.xlsx

  • Size

    688KB

  • MD5

    dd2f4303249786c6fa25e9b16664f1ec

  • SHA1

    9fd8215c6da713423874bf29cd66dc87429176a7

  • SHA256

    f0a27618b5718409b3f2343a223f7d75ae36ab893f98315a13fe492b29bd81d1

  • SHA512

    462ab897b86af39973fdc8db736d4079032c1596538bc0000c69e4d869f896e2f54d7ecf308f5654da5791bccc6002184f38c32807a1605e1a60390c7ba026b1

  • SSDEEP

    12288:DdtGeA+wXto4IFqqAzAsOppH5RZ6DF83ND8hc/ejS7j44RhTBkP:DdtGewXto4IZAzKTjZ6DFkNgc/gS7j5c

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2