Extracted

• • Target

    0530d54b2b5991438af0651976bec3a26660b2df5f6e21669700f48c9e810df8.xlsx

  • Size

    665KB

  • MD5

    f290c0ba11cf19dd6f4950c9a5668c45

  • SHA1

    0c9889f0c02c53ecf67588d279d02ad948cf0d93

  • SHA256

    0530d54b2b5991438af0651976bec3a26660b2df5f6e21669700f48c9e810df8

  • SHA512

    03c1d493f0ccb6ad009fd2da765267f0754dd0e176147d65f5d0761e0f40f4843bdd764bdafee0519795f792a1e3866f85d73836b35424a531c174e53b6d38c9

  • SSDEEP

    12288:/aZJiMBVwRQDPIPz4hLlHSEl7ebLNSB38vzJJkubHOVEgJUSO:SrXjLxEbLNE387JJbHmEgi5

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2