Extracted

• • Target

    Pepsico RFQ_P1005712.xls

  • Size

    111KB

  • MD5

    9eba63f385b6efcc868f163cc53e5ef6

  • SHA1

    8da5ad24a8a94e035b473f82e03a57740413998d

  • SHA256

    47ee3997168e1d2f64c940453432642e7f7cea124561a40904d7d8d3b58d2b75

  • SHA512

    6c47a8bdfbc30422ab8805fb98f454ee8b71f65057e334a0ee7723a90d2e864efa44b02e98a3984f315222065002d3cb8894b99734807f78045811597207f342

  • SSDEEP

    1536:VU0BRPw/jF2gE+wxQAOhUMqTjfktX/t/qr2ml8Vvygn05kTheDm/:y0WF2F8ATjio2fVvr05ehe

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2