Extracted

• • Target
    Proforma invoice from DPC 20230827 (CNY).xls.exe
  • Size 698KB
  • SHA256 ec35b0c10000f1cfcf5e667c474e1ab439dd9ef1f62a4732eae437b4c968a1cf
  • MD5 3c583856df2ed844228cd21834f55e27
  • SHA1 c1e5f6900b79b8c207b1ac50c45548fc8ffafa0b
  • SHA512 70183c8adac8581b17bcfcbea44e7e3f5bddb00210e327b6f35e9497d70da911b4405b09c86143089ed635c8c1db3640474f04377b351d5401dba6a1261e0eb0
  • SSDEEP 12288:AxSqvBt3s3ni9gXxuTap7qYBlM/A39ThK2TcWwjm:TQc3iiXUC+Y6A3d
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2