Extracted

• • Target
    PO109643.exe
  • Size 756KB
  • SHA256 332287b244dfebbabac15b5b4dd3fc3bb6f488d3460c2de5259254136040d0e4
  • MD5 a3a7e5910a87e75cd503c5b25933cf1c
  • SHA1 e24b0858a9bf21cf91f445220e3f6bfc2d83852b
  • SHA512 f1b1eee921e6a6a0294c92f115d51e73d658adf87f3fbc98c39b6af0f09db12726b9b8c02aadbcaa7fe6a8b6c847877b0c26db64b77fd03b7c7a2718139cd635
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealertrojanspywareagentteslaevasion

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2