Extracted

• • Target
    nuovo_Ordine.exe
  • Size 472KB
  • SHA256 6c74ca9ce17decdf3ec659c61aae4b2835b4a829fb2a285d5b36e38b8f86a0b4
  • MD5 ac6d529a73eadc9ed407bef4e5522ea9
  • SHA1 2b4d5a421414b32816cb5eb094d62bb351891cec
  • SHA512 a05d3740761b1bb0739b629500ab31cf6bf11b874940067c2467d29f3a4a40c363d5f3b8b76a67036e45fd6472ac5cd57699d432b0bb4b4c42f8cf8cf2153dbe
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Drops file in Drivers directory

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2