Extracted

• • Target

    SIGNED AND STAMPED INVOICE.exe

  • Size

    457KB

  • MD5

    8c7516016e1bba2fe0e81b1792d9261e

  • SHA1

    7d4851bad01bb5043d56ea2fb480b952cb087b84

  • SHA256

    0b2ade3b609fe52eb27078440fe30c4983138af0a04bda84e92df8830338c9b1

  • SHA512

    5f36c3f281f8ed5a22d6522623cef0839aebd2b6bebbbdeee068364827d11063d42656719309782843f6641687f1cfefd35b0d8d9fc03fb58a8f7b5360ada92c

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencerezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2