Extracted

Extracted

• • Target
    Order_4488577_list.doc.exe
  • Size 505KB
  • SHA256 e2ee107b59612c9ca7bc1df9d460f3c7205503aaa92346bcab201cb7c153f25a
  • MD5 3089c7102435d9700d73ef949b43f634
  • SHA1 5a18fc13f09fde131207b0c0ea723da477804cab
  • SHA512 0e8f3cf8de7c91ed16552d978be0ab03265dbf1205f9706c53c7db938cf6e4645bc27f9620e053bf7d3b80e8d3dacf0e2291ac988c46e9ac1f3bc1917e57001c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacoreentitykeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2