Extracted

• • Target

    2d334ff51483236fa87270be95e77b196989ca1c9bea4d803aa059c4758a917c

  • Size

    1.0MB

  • MD5

    e534b53d075fe29c9aa3030b7f4cd661

  • SHA1

    7369f1567d017938b715d624d4635f867d24989a

  • SHA256

    2d334ff51483236fa87270be95e77b196989ca1c9bea4d803aa059c4758a917c

  • SHA512

    ee6ca412f6b8b71d1eadb64ebf8915cda679e2c98fa80cd84119934beea3c75121b2a6bbe8075907b95c77e96698bbf8d383cc59a7dde7931712ecace321c569

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojanmetastealer

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2