Extracted

• • Target

    SOA_JAN_MAY_20_doc.exe

  • Size

    500KB

  • MD5

    2e1a3f171e9adfb0cbd28a59a72409e3

  • SHA1

    5a2b23a48bc746f333663baffbe9b8e166a72008

  • SHA256

    dccf76439fbd7e0afbaf8b56edda49b8a842c4b9447a9ebcf71874a622abe2c8

  • SHA512

    91da04f3ff9f893e1d4fe7f1475ab525d5b75bc021d3d6ce746b94988ae246a0970d6841be1b6fe8f7c4cd79bc6215d10547c4b02158630a2f8c6a1412a1a057

  Score

  10^/10

  agentteslacoreentityevasionkeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2