Extracted

• • Target
    New Inquiry PR #270473. 05.10.2021.xlxs.exe
  • Size 509KB
  • SHA256 8664bd0c09f992c53b0db3db2b6d5b5a14802fc7dd98d2e820d2df78fd26764e
  • MD5 24c03eb05429ceb15107042b57b23c1f
  • SHA1 3d8c35372e582a8741bbe3fb28598372d56cf7d3
  • SHA512 dd5527272e85a2229857e3acd0f10daadd686f9c53b2aee745677a161702ef4f5b360139917bc3f3c5089a4cb6d7663e0a6794b5a4d96056850acae61e5671d8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2