Extracted

• • Target

    RHGP0987090H.xlsx

  • Size

    2.1MB

  • MD5

    55a94ebc4a3702f57aacb4633d36424e

  • SHA1

    eb1cc363bbe0e61efcbb9fdb31d58b3cb714189e

  • SHA256

    9bd66b6fa9050edf01d12180e4569c464f47e3235d5a912c9d2e91b6461e8f23

  • SHA512

    adfcf48ac7cc0d40ee8665eee45147204a721fd3205febfd1ded8738104684ebbd74cf7e8fbef551cbd6c82b9999e1f9546918a79b3de7fb23d410ba82d0f5e1

  • SSDEEP

    49152:cpfIiqBbNgp+blM1X2fjuQvW4hMalpBgNZVOhOPsTRYLXSOu:8eBbxby1ejuQvLxpBgNZghOSYud

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2