Extracted

Extracted

• • Target
    USD cSWIFT c_SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.exe
  • Size 424KB
  • SHA256 ba4587bb7fef7fe60afcde3742183472840eaf7ef122669ae3f94eaad245fd7f
  • MD5 8643e31274a2766b0263166c854217e2
  • SHA1 e9df18bdc355c715692edfe91f4e700c48a88310
  • SHA512 22354b1c90678cfbab2f800724c6d1b8f6618d417249dfcbd47261bfd2f94a82048539e13f8995d241c314cbb4f663a3b3b719571a3a8126e12c49952f0fe190
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2