Extracted

• • Target
    FR00098WED88_________.com
  • Size 411KB
  • SHA256 359c6dd6d5b5d3b1a0c3aa744d1df91f083efebeaf554b251d1607775d2dba55
  • MD5 55041e67523a23b8c38cb0986fa80081
  • SHA1 53ad642ab5f78b27d8d73a0af337578396863a58
  • SHA512 cd492e20836cfa961d06b96b9a0da34f9d70c5856d140aa463c1cc538ee927974a7a1c6eb20153ff9e966033b06765d06854f81e34a757f4611b05ef490f7f0a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Drops file in Drivers directory

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2