Extracted

• • Target

    11a5d3add86410357163004a54f22335583b895a390e7eaf567e423ac7ccfeff.xlsx

  • Size

    829KB

  • MD5

    8ab8d813d3ca68c8effdb8abbf4a4f86

  • SHA1

    f26fa096a70eec2a9900e363f63a1e6cafe5e8d4

  • SHA256

    11a5d3add86410357163004a54f22335583b895a390e7eaf567e423ac7ccfeff

  • SHA512

    cc5afb9559e049d62133d89c488d12b81c8338bf29177def06f890310ae75ae2964a21d07e3cf6bcbbdc103cfdf102f1ce35111ead80f9c8d247c8b8b663f0a5

  • SSDEEP

    24576:7Y6dnGcLIS97usf6ZHqRPK21eOWWiB5Etu/3PP4qZaP2/:7YEvLISHkqjEhWVt2PwqZaP2/

  Score

  10^/10

  agentteslacollectiondiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2