Extracted

• • Target
    01_file.exe
  • Size 1.8MB
  • SHA256 4c482b22456df2e37106d59a8afeccdeb736ee89b13b3de6968acee2f3ce9f25
  • MD5 6c4a9f7c8893254e10bc2217cec26aef
  • SHA1 73a0452fbc80e1d7782888e28c46e49d7e01ebd1
  • SHA512 0266942220119efe2241b66604c51cf6e077118a4eb4904f8f4a3dbcd59067a325f416fb0dca8ef965e6749aae4e49eb1fb2e159919b6e513e89a599cb775491
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies WinLogon for persistence

    persistence

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2