Extracted

• • Target
    New_order_23102025.exe
  • Size 2.7MB
  • SHA256 7fc90f92f50d98b3bc737f0de1fd17c2f24ae9a72fa2ddbb67c55f8dd73d700d
  • MD5 376809d4de1459576198b40a875a5114
  • SHA1 8889ce674618564846048cd46d25a8fc051cbed5
  • SHA512 6e1b725cd46e8f9263ad663b9a5477b6a0766a6d1dffb9f84b26dcd04b7fe92eecdb252c0d38c7b63bf6ee27d9b9be3de93bd62b3f419be5ec19eccdd2ee378a
  • SSDEEP 6144:3FBCIG0+U15EFpT/bpDI3S/7866KKfxwAtYSRY0LxP6:10f3o5KpT/bG3K6BJtYSY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  crypterdiscoveryagenttesladarktortillakeyloggerloaderspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Darktortilla

    DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.

    loadercrypterdarktortilla

  • Darktortilla family

    darktortilla

  • Detects Darktortilla crypter.

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2