Extracted

• • Target

    General Cargo.exe

  • Size

    1012KB

  • MD5

    ac0c7a455bed237f93ae233bee8ca2f9

  • SHA1

    f23f3219dbe6f70b991907770cf1375508767fc1

  • SHA256

    c941df58802418088a3d995985f0582feb2f1fd839123e0e0a580d4610e54259

  • SHA512

    3f1632ddc08249bdefbfe3a18a12a9a8564c2f9a60d4fad787184fbdde5b46914fecb58b769c7afad4f92b4092b9f4ac43be10694918a663fe7baf423a677b17

  • SSDEEP

    24576:z+A6w+hh3TkPKbQeuyV946GorX3g39fKQA:6A6w+/3IPKbTlO6Gob3Gfw

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2