Extracted

• • Target

    NEW ORDER.exe

  • Size

    740KB

  • MD5

    161eb73b1e04a20bad1b9f47716abe8d

  • SHA1

    0fc916438fb79d83b1232a9c6913a599ffa5c641

  • SHA256

    5ae71498e3b1d2707c84bcd6f43566b8834f310dccafd64ef81e54cbe7ac4b01

  • SHA512

    1b27317105bf51911ad5e355bea51278dbf49d72365171eba914bfd612a40839490d073be4bd9974a9d51330c869b8aa18b88c860e19869249a533df18498d50

  • SSDEEP

    12288:ADX3jNNQniCpB5A+W6nRHDWcVYuhi1xaDjuY+wuzaLWUrm9Osd:ADnjNNwrAU5DWcVZPDjuY+fznjH

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2