Extracted

• • Target
    5Q8pHbBGhl3t1rx.exe
  • Size 555KB
  • SHA256 3bcc71c7eb84ab3cbb2b28919cfe161ad1e809effb2b6095ea711835bb9b53f2
  • MD5 18702466fcf46387625c080d4d745185
  • SHA1 defdf31ae9465f9c02cfaf3fb7508e185601e95a
  • SHA512 d95ca524abb776a3a78a87a0ed95735f4849ea49ad7fbeb13b21b919096032f21484231366c026877066fda24f8308e4492ca38cf02f8c2316dc8917b6fe8426
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojanpersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2