Extracted

Extracted

• • Target

    fedEx shipping document.xlsx.vbe

  • Size

    150KB

  • MD5

    48567dd418e419f7719a3269ad3a22c1

  • SHA1

    9d69ee9e60a316c98e7a87d90cdbfef4151175c4

  • SHA256

    a4f42049afb44ee3a5a075fd716d4a271cc1ed18ec41dc12a076e6f5b79372f0

  • SHA512

    a2cb14c886e74fc207035a6cd6598e5d841410d2a2f9603cddab4321417cb3811379be11ab085509afa255a6e6fd9b536ca9d11d17279f16c3c722e48fbd0eee

  • SSDEEP

    3072:PZgFwtD6gOsxOinQA8T7IRaZgFwtD6gOsxOinQA8T7ITZgFwtD6gOsxOinQA8T7N:BgwkiOiQLHgwkiOiQLYgwkiOiQLN

  Score

  10^/10

  discoveryexecutionagentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2