Extracted

• • Target
    STANDARD EDEN SERVICES PURCHASE ORDER 4501140425.exe
  • Size 870KB
  • SHA256 16fa7388e5068b34b2f63ea9146e09c66680b35524bd8dd3f517583bffa1be02
  • MD5 5b7a40686d04b46f17e9028b8386da50
  • SHA1 8bf346bfa903836cac4cd084c25a21626b88d19f
  • SHA512 84441da1a05b6b523f2a4a229ba296e2f8acc7bc71d0e64d2bdd5cf576106a885389e21b4a4870515c570442a799a1d936b1dca79f2227dc6e717aed741ac534
  • SSDEEP 12288:ap/RgTslpGCx/NNYSCGJluTNmOpnV4K5tnDgc7c6Yd:nsECxj1ngNmE5hsc7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2