Extracted

• • Target

    LEGAL ACTION ON YOUR COMPANY FOR LONG OVERDUE INVOICE.doc.exe

  • Size

    446KB

  • MD5

    6bdd9c15243bd5b8709b87b7ba10b3a9

  • SHA1

    780f690b92f29296254f00b9f1958c2359991ad2

  • SHA256

    2580575e95648d76aed0be387fbe6423ef72639b8aaa9e1ad84ebc5b74bcf7b5

  • SHA512

    46a0f1f8a1c6d6cfbea8c287cd9f06fb44e987f8c452a2e5f99da852d871de1552a25eb7d79c794c817e16c7917d3e39383046173699c1fcc07f53dec0ec5cdd

  Score

  10^/10

  agentteslacollectioncoreentityevasionkeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2