Extracted

• • Target
    33bef8d54cf93b30251b1b60dabee88a.exe
  • Size 408KB
  • SHA256 bcb7da4d62467320eadecfe6d6157941a2b73d24a22925465bacf3c434aae525
  • MD5 33bef8d54cf93b30251b1b60dabee88a
  • SHA1 d1e75da331171b4e80c75cbc29ca637885df5125
  • SHA512 65fecb3205d2f6f976168878d2b4af17b4f3bd0112fd06e70e2b3d005667eeac2c6e40e7c1077abf04681b981a2a495fa71c520916e381033c750f9ce49d97e2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacoreentitykeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2