Extracted

• • Target
    order inquiry.exe
  • Size 1.1MB
  • SHA256 dd4ea18ad31ea687c2a79471ee189de7912974f778d6b0c9b9575ead3f6386c5
  • MD5 6fbf78f1514c205eb0b7db30bb0cb969
  • SHA1 9f26296381482e0872732b06c02f6089c99f075c
  • SHA512 f89900e30d2c263ef28d4fe4380ed348013b27a146d655a3d85870b96ef7e84992df4fc6cf07e6bbd1acdc8159837a96ffa035d2e3a4f3b88af69d857db66670
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2