Extracted

• • Target

    New Order #QAY3763.xlam.xlsx

  • Size

    660KB

  • MD5

    3b65d19f4f8f6a78f0b81a76b4377466

  • SHA1

    96e39dfd3899d6c2c0525986bb98f62daf3bce47

  • SHA256

    ca94f672e0a78076b32e25a4acd186f60de0986dcebcd4d8bb61f3ceca33eb01

  • SHA512

    001096df097bd1929fd098812f4318282a121d6ce86ca6ff0ad072313cec79cbfe1fd634cad82fcedd0347631b61528c4a36c8801d74041cc68b719b4b48588d

  • SSDEEP

    12288:Wok4BI3UyDxjeRcWQ/HgtBAZINcIOIPHd9yBoju85QCIp/f1:44y3UK+JS1ZINjA8ni

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2