Extracted

• • Target

    Factura.xlsx

  • Size

    3.9MB

  • MD5

    5ffc2a72ff05e1f486e4aa0142b89a23

  • SHA1

    1d7428dd31e095b0aa43a61c962e7d42587c3f0c

  • SHA256

    0f626eca4a80a70619bded3da7db0cbac8de8effb65482cdf05962ff789155be

  • SHA512

    3b9753133f33901cc5fe4cc9e13ddb860b6a4cbae572ba4aad0149589c4b162caa9352dc57831d9c532367e5f978e22de34612566990fd0e83aaba4797cec7d4

  • SSDEEP

    98304:fxCNiZcsxN2HwHTiOsR1PWdVUnugvD50Dm:ZC8ZcsiOPdEugvDV

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2