Extracted

• • Target

    PO#6012001198 54387-403 A#800779222 LAMBERTZ POLONIA Sp.exe

  • Size

    452KB

  • MD5

    e2a4d4c11386806bce8e5d8d5e8e8371

  • SHA1

    9c94b32008c907d15149dd1740ef4a92a7edbb88

  • SHA256

    dabff599f798510f8acfc9067feddde27050ed506d55adfac28cc2f938574002

  • SHA512

    9a6ed6fb674846f9d0fd3f9a23adebd611326461d0e681961e54c1f3f78386355281def63c1e0b223c2c8454be62466490ba4cb6771e3ee0f074ee5f2b03771a

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2