Extracted

• • Target

    new purchase order.rar.exe

  • Size

    523KB

  • MD5

    e50b58922768f36a719aa5e91c086c06

  • SHA1

    f2216e02ce43d07bc6bc8b7fb01461f1d9d1aa91

  • SHA256

    a4d3085a47bf0da4fa557e18de19bada74667d0eaa3dca959990b96215bb25cc

  • SHA512

    ba6be2906587a73203196853952878e017e99ad94edec3195a368edd99f9fb0c2ae3218b84bd943a57f0cdbbd340043c0858b9e050f330dbacdf26b45f32d078

  Score

  10^/10

  agentteslasnakebotcollectioncoreentityevasionkeyloggerrezer0snakebotspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • SnakeBOT

    SnakeBOT is a heavily obfuscated .NET downloader.

    snakebot

  • AgentTesla Payload

  • Contains SnakeBOT related strings

    snakebot

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2