Extracted

• • Target
    Tender notification05.04..2022.doc.exe
  • Size 842KB
  • SHA256 fe1f268ea15153b6f0e9935ce18b75a2da354ab2f84c3662b29e21054bf2cc22
  • MD5 6aa089da1b3580a1aaefdc3f7b7856fa
  • SHA1 32cb589bbcae3f339d6ecd0a5a68231a50b2a92c
  • SHA512 5bccc21a1a74defb1d37acabe7cf582be607872276918f1fdb86d2c91472c720e89f0ac4e4be272f2322b06d7dc1d17d8e8d7db94dd1ec2cafda686400ee554b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2