Extracted

• • Target
    INVITATION TO BID FOR TENDER.exe
  • Size 951KB
  • SHA256 8ae671d5515672bc6adbb32d2ab738ddb93d00553679c01ac69575f451cf97f2
  • MD5 c8ff8e828c3816031dad3e5393937810
  • SHA1 9bc9501c56857394b561f6594e032b4b5597a192
  • SHA512 f9eb2140460830c49415b8496c0e3ce2d23c8307f729208ff407c358009c18af9ffd3b06a0cbbb3f4b664205e844fbf0296978159e0e6ce3548767194e66a0c2
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealertrojanspywareagentteslapersistenceevasion

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2