Extracted

• • Target

    cfcb82dca4f5a92e73fb77de00cd8da789af7730f589712441b6faf790babe43

  • Size

    773KB

  • MD5

    ed6e71c980078e893bf821379d994f4c

  • SHA1

    ff2e02bac29ce96002992cd3e03a824ec41c9cf4

  • SHA256

    cfcb82dca4f5a92e73fb77de00cd8da789af7730f589712441b6faf790babe43

  • SHA512

    30262e84a91c7b90b5a4a048182b7068a3d7978bbd2dfa9a2b8dd3d29d334fe6d6002dc6dea7818ef4b614586685b9f98e715372f2a8453371e83d0e549c14a8

  Score

  10^/10

  agentteslametastealerevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2