Extracted

Extracted

• • Target
    ShippersCargo_CH05212022SH.exe
  • Size 540KB
  • SHA256 beaa5c13b3a73673a51f0cf8a2c24ef5ec65c3bbe0007520d4af6c37a8d43aca
  • MD5 20aad442210b535878e3eef30eaf8a61
  • SHA1 3e1413f1e6c81f18c4e6085938370625ed5d2fb7
  • SHA512 485e36aa5218637872fd6a9b45de55664ff44b5dda5c7f31ef46bcbb485054e7cf645d5b2920c948dbeb003a62ce482152c509055c2b5ee8e0d31b6a3269c52a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacoreentityevasionkeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2