Extracted

• • Target
    36828e8ba8e39939e864288010d554c1a098a89f414b5ad8b52e97169122630a.xls
  • Size 279KB
  • SHA256 36828e8ba8e39939e864288010d554c1a098a89f414b5ad8b52e97169122630a
  • MD5 b806f1868f3144102f73f43868d8b031
  • SHA1 cc98fcdd285bb0f935a0593776f6c6182faf7044
  • SHA512 90acc08125ca194c70286fba432f5145e8bead5abb8cff700ac2c5bb954966d3daa29d04a24e91b20000382e60bf5fe5d854e97e366d2cf692f76acf9cb0868b
  • SSDEEP 6144:3qFzL5LIT47HmPWNBjZpXIoVvneEJ28+B3f1S6D+Hx605p:3qFzu4LmPU/rdeo28+Bt7L8p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2