Extracted

• • Target

    citat-05022024.xla

  • Size

    239KB

  • MD5

    8b96bcae9b00af1649c5433e19b66f52

  • SHA1

    f27187cfbd9c3ad22c6ff8cc16f106a26437f5a8

  • SHA256

    91e300979dbed56033d3f9f821abbf631c71858cf9747fa65011c2fe1c515a28

  • SHA512

    141f19d9365fb9125a300a522e404f8a024e14c94b45ec0c0fb9e7b503341f22ee4d3eb7c79886afecf342d68a39d6e71f67ed4c48424ee70592dc9e6b406386

  • SSDEEP

    6144:id4UcLe0JOqPQZR8MDdATCR3tSv0W8DNy/tgG794Yhk:lUP/qPQZR8MxAm/S8W8B/G794Gk

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Abuses OpenXML format to download file from external location

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2