Extracted

• • Target

    ORDER#321550 YOEW AKA DWC-PM-1173-121 International DMCC.exe

  • Size

    455KB

  • MD5

    ff32efcb494ca35aa47a2d0d647d3546

  • SHA1

    390a510f45a735aa14940fa46370be62b721a004

  • SHA256

    f864c078bb8a27ef5ff44af23b3829894febdba1a0dd692fdd423717086ebd4e

  • SHA512

    6f117fe2d535674dd6c973bf1e082cb1e26b4c3853cec404565c7e390c5cbd087ee9004c25bc1c834b72f89eaf739aea728ee0118bb4ea9e8a6f606dcda55173

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2