Extracted

• • Target
    shelovedsomeonetounderstandthebeautifulgirlpleasetrytogetherbackfromthebeautifulgirlsheisverybeautifulgirl___ithinksheisbeautifulandverybeautifulgirlsheis.doc
  • Size 78KB
  • SHA256 01a6c09c9829bdea8ed5dec785ce2118b60bba4a84f23c904c5d54392bee4fe5
  • MD5 a2b050f9634ea0c8cb1456e13b59b505
  • SHA1 46520ed89967d7ab20390a76a016a0d53d55b587
  • SHA512 7100b1f37ecdbeabe5cbbeff3fc9b94ac4fd08d78593cad88daf707d4ad24618919deec05eab55d422d03bb95b30fd89d4afbc41796aa5d18c3a03781bc64889
  • SSDEEP 1536:0GNGRy3OUvo/I2mRQ1l/pZwKdmvRU1UtMyeyFp0oTek3utR5mFOpjNOFyZ7M:0GARhUvo/xmyDNdMGIMkeNpm4jQFyZ7M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2