Extracted

• • Target
    Urgent Order.exe
  • Size 1.1MB
  • SHA256 5067ae4261feea16e5b765d748a743eb9f55d86cf795c0213ac3769049e7dfba
  • MD5 ed4ae654e0bbb7058128fef7bcad32a1
  • SHA1 015a1b2d4c10af211b9d400ca44c263d9badc960
  • SHA512 9498607b3e7fa4c2afad2aacbecdee65a30309116fd907da910b77c552f879f6bfaf2c3a9939cdad72c6e67842683848e8bcdac78625a62dabe99b318aea36ce
  • SSDEEP 24576:AfsmKoTTc+v2GU50m4Kq1e+ho463tsEbIhWozDeZ:Af3K2Tc+uD5uhendXbIBzDe
  • TLSH
    T14535F114629FC806DC5A0772C8B6D7F403A0BE8AE812F2535AE57FBB367AF574844352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2