Extracted

• • Target
    Rev Cont CD20(3) SC# IDM392(20) SC# - DRB.exe
  • Size 598KB
  • SHA256 1a74ccf719aa43c97835fd2bd03de4c85d4d4eaad56482b8d4d70e3f8beac769
  • MD5 21d3d4a548696aac6bbe682a8e745213
  • SHA1 58ead3fe064635fe331fb5d6788a9b27f2ddcf74
  • SHA512 63ec84ab4754a26659f83e26e38921074f19a38a7d23e41d15d4f159c5cf2d37395e946b57c4a4462abfea44f78cc2dc0155adbece076e40ce445f0ecf0de38b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2