Extracted

Extracted

• • Target

    PO1276579.pdf.exe

  • Size

    602KB

  • MD5

    c04479081b8da67dec9f6544a3203f29

  • SHA1

    0b6d2fb73fff0ba587e1bff67e57ad615a106dc9

  • SHA256

    47921bae52d2d80acb35c1f4ca3e55f4608f76f774713d2578115e74537a897a

  • SHA512

    a0b0fcd3f255178d871cc8849e89bbeec707bb1761bc847cc0ef3b2d4c98aac4ae511cedfb2105f10f99bb4c90ea9dda5e0302e6bd20554813971b4cc2bec871

  Score

  10^/10

  agentteslacollectionevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2