Extracted

• • Target
    90404.xls
  • Size 280KB
  • SHA256 f74e82ed2a6beb901db5cd4ec0dbf5d14333b9e72d13250d0abf83434fdfe230
  • MD5 f9616ae0006213b36750a83a98b97e35
  • SHA1 27207475178759c1289916a6eb509c922c2c90cd
  • SHA512 828aa264926bb21ad631471bc68f79e29e4842c0da7fdd2052a57edcebd07c75e7c4a258bdf12f39332923d9a4969c852170f7face0e41f3254ae99fe9cafae0
  • SSDEEP 6144:TqFzL5LIT47HB0664TTCr2YGYkfxSw+lC:TqFzu4Li6hEQsC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2