Extracted

• • Target

    NEW ORDER.exe

  • Size

    981KB

  • MD5

    5f9d30eb9bef9905b589e731643c4c0e

  • SHA1

    ecaf5e67f600b6e4016f441a79594e8fcc3a7d67

  • SHA256

    e28f384946d7a17d59de700e40186725163b534eab150d6be5327187e7f83a28

  • SHA512

    033bc257cb86248394815de68d698291f5786a6c53f8edd4f3a7dbaccda9d93c502d72bf7f14ca0d0aabb01a40ff12e8811564dc66442adcd5d2e7169c2f1542

  • SSDEEP

    24576:xl6EdjC5OCuNqGZpM+CYQyb0FXa7uczQ8cgiBq0SjbYuX0J1:xl6EdjC5OlRkRYQ+0taqczQgsq0S4dJ1

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2