Overview

overview

10

Static

static

3

Velocitylol.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Velocitylol.exe

  • Size

    3.1MB

  • Sample

    240904-ekz1xavbmp

  • MD5

    0c33284728a138decf9bf5229bc1272a

  • SHA1

    41bac3740aee663620d82503e7dda4cd3f564eb7

  • SHA256

    ad013bc1676f0fb7f9dd576d5d96e4b121770756abeb70379e01d0003dca8681

  • SHA512

    0c9a0647418ffdf03ca31db1fbe7152a301953d1fe9a7115f18271c4690ed72af0e2b0acf9f6ad05234e6faa7cba759d815435cb67536a1253f1959a953a6622

  • SSDEEP

    24576:cm+UY3EpCIJyWcl/Pe8FeyAK2p9KVQJ/nEBd8jjePIVCJDQHfsJpeLAb0BsqJEZj:NkY6l5vePmrlqqZZp/wuERzibxCfAz7

Score
10/10
agenttesladiscoveryevasionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Velocitylol.exe

    • Size

      3.1MB

    • MD5

      0c33284728a138decf9bf5229bc1272a

    • SHA1

      41bac3740aee663620d82503e7dda4cd3f564eb7

    • SHA256

      ad013bc1676f0fb7f9dd576d5d96e4b121770756abeb70379e01d0003dca8681

    • SHA512

      0c9a0647418ffdf03ca31db1fbe7152a301953d1fe9a7115f18271c4690ed72af0e2b0acf9f6ad05234e6faa7cba759d815435cb67536a1253f1959a953a6622

    • SSDEEP

      24576:cm+UY3EpCIJyWcl/Pe8FeyAK2p9KVQJ/nEBd8jjePIVCJDQHfsJpeLAb0BsqJEZj:NkY6l5vePmrlqqZZp/wuERzibxCfAz7

    Score
    10/10
    agenttesladiscoveryevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks