Extracted

• • Target

    ORDER.docs.exe

  • Size

    458KB

  • MD5

    0a3333ff7bcb5dd86f29a640b400e2e8

  • SHA1

    49bb20e7fe343cd4ab8f5048b97277230082004f

  • SHA256

    9a1c9a14cefe34731b24b163dced4eb630136df8eeee1fc69babc26db5b5eb35

  • SHA512

    9c7d1e2ec923e722222c446151d9240a576e1bb70174a0960c06fff81657af685288880ad78713cf47cff742adbd8fd36fc7a9ba825d1fc7b8a9dd2aba79e485

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencerezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2