Extracted

• • Target
    SHIPPING DOCUMENTS.exe
  • Size 875KB
  • SHA256 355264e0bdde768122e4797e12b658ded5235a012aabe250e19dcfdcd984e96f
  • MD5 51e640d7868650387dacef88f1d14c96
  • SHA1 0de407e675ee29c2831652f103567918ace0e389
  • SHA512 48ef38620ab7e2137b6b8344c678d91e9cd6e096c5b26891c456c3ac0d87821f006912a1bb5f6f002bc46c0fb2626e9a1e82063b9999ac33e5703ad43b16128b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2