Extracted

• • Target
    SecuriteInfo.com.Generic.mg.994c2b46c2ce88f0.25415
  • Size 731KB
  • SHA256 dc4eaa151b01375e0ba2392396b60e6abebab99e5590c93ab23ee3063aba5eb5
  • MD5 994c2b46c2ce88f0056ac51fe9201f7f
  • SHA1 8b8c16ec0482caf8cf113c33c6c18651cc25441c
  • SHA512 7045b3b5f75b4ed41d4c391c2f6ac4523255a3f177c2e6e92521d5217d720dadcefada37c78420fdc7ca5f80021c387948bd7161da854d495e03b8752bfd13a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2