Extracted

• • Target

    ccae6dda8f6f5637da407188751ef9265975ab9df9f5c0d423785637bfd75bf7.xlsx

  • Size

    707KB

  • MD5

    ee98a1d52ed736d82191c974a7a66694

  • SHA1

    e52a106550e320656166ee1a0a1b3d01e6f7e9a3

  • SHA256

    ccae6dda8f6f5637da407188751ef9265975ab9df9f5c0d423785637bfd75bf7

  • SHA512

    19153bf69604a9f5127fbe6fe4f4230b9d4fd99df0169cbcb6521e227432f046f9355b2b80a3de05383658afa2b8edf2099e70e83894449b1429b6eda3818bb2

  • SSDEEP

    12288:VjzcZCWMQ+EeXzhbVDKRiVXJcSjqfV6BPQxtlZA00Cp4LTohRHaQ16O33gXqgxTI:VjoSRzhhDKAVmgaNOLTIHG83roWyY0yL

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2