Extracted

• • Target
    Teklif talebi.xls
  • Size 409KB
  • SHA256 436b6611d9594f8c40663b160281894e79f2aeeead84cd2b0d5452c88558c220
  • MD5 708e46f7c350078734fb5c9b9c400340
  • SHA1 5201dc554fe1464f6a3c5ffe094c383f3432b1ec
  • SHA512 bc2809d2a8f9f745cfc34180c4a0139d88e382ed87e82987880e3fb363b18f19c96122ab5fcd86215502c2e7b0411c8655a55ce5ef38a5648053b3d14aabdf7f
  • SSDEEP 6144:gqFzL5LIT47HjxnEp2om5xxuiK1lc1jXY2EVT5W0u5ZrQf1E1kG7Dlp/JjV3Q:gqFzu4LjCp3m56B1l+U9TIN5ZpkIlpx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Abuses OpenXML format to download file from external location

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2