Extracted

• • Target

    3M KESİCİ TAKIM MÜH FİYAT İSTEĞİ820272023.exe

  • Size

    1.4MB

  • MD5

    004fa1dc876651dfd0496d1618aaee85

  • SHA1

    8e3eb714851e87d9c11529a2404fe26a5f2c43c4

  • SHA256

    6e87e1c7ffeeb2ff4badfb5a7eff18a8d55de2ff5efef6ab1ec4820048214318

  • SHA512

    720d5e44fb7cd238e6f597c21fe340aeed9c88008644d7ad3c25d93cc138b2e52375e29e450b559c205da755fff967c86e69f86d100b211bf671481f7860901e

  • SSDEEP

    24576:xwiEM3bSghVC7G7bwXCrRLq0PqE2qpbh4lz1WQqp2pA19CA9+:6cb1hV/8X9E2qBh4x1WQAl8

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2