Extracted

• • Target

    44ce9bbea2b67d562f6b2b7941dc55df7049621fe8ffde240686fb8b7bfd4354

  • Size

    23KB

  • MD5

    e7a25f77d121b2a3821c3d8b0c47060c

  • SHA1

    d4e3bc63059fca99a3f945195488569cfdb6d816

  • SHA256

    44ce9bbea2b67d562f6b2b7941dc55df7049621fe8ffde240686fb8b7bfd4354

  • SHA512

    04e567a102106494abb21ba60b65dae52d65c1b13776aa0f1517b9337591a14895a72a8d924d229c3bff76a57f7a34e883d7f7ce42bab431ba4ba1245eb6dbc1

  Score

  10^/10

  agentteslawarzoneratevasioninfostealerkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Warzone RAT Payload

    rat

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2