Extracted

• • Target
    SecuriteInfo.com.Generic.ML.PUA.9673.15791.exe
  • Size 671KB
  • SHA256 ff861cbd5dd1021564dbd050ee3cc084a7cc05d45295b3abd3ceb1cf020b7a9a
  • MD5 c25a99ed95d1345c4ee605eb331ef1f0
  • SHA1 11604f25cf598af4a9474b2a3e316f109981f312
  • SHA512 e3eb66f382ec5bd6d28ffd0330f874a39b3145796b2d1b4db60b5416c12a52bfded2415a302d47b07fd29b4ef6bcc84eb02ce77d1f2bbfa616b442f54776839b
  • SSDEEP 12288:fe7BWyNTJmhSV9OYufNOhfWUrqWQ4MifPHzsdilSE3qvz:27BWyvWSV9SfNMfWUrqWzNPIdilS84
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2