Extracted

• • Target

    P51BzRf7dvl2tnx.exe

  • Size

    492KB

  • MD5

    e6e53c442ce4e6b0d865e4bd6433f8b4

  • SHA1

    519ed18150ce8f63aa4bb4d2ac01e9bfa4cb6e9b

  • SHA256

    38a83ed65dd375ad496b01eb7bf0f050983b1a289f1fcb01e9898fa7565ddd63

  • SHA512

    c5f8e390767e3fc557dde88dccf4b05e965f15998a0f7b526aaeb900c24e7950a4d8f0377dbf4e580c93dd2ae164ba9ee4c0393c648de6cc9ab7fd2acec28720

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2