Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.9912.9271.exe

  • Size

    748KB

  • MD5

    6d5ed640532ab33cbe0aa1708bdfada9

  • SHA1

    73be9147365cd5b73097458847ab63b4c1829a1a

  • SHA256

    cedf884294560a24075290eb087b2731294d9b6de25d36c1876e710c9ea2743e

  • SHA512

    af65786b4795d4238b404c17f7f317e51bf337a529026a4eba0880e739d5fc0625f142ee609b5ad7b42469075a250c1f06be564cff8e4d95a20f27f4d9c9994b

  • SSDEEP

    12288:gIJEecLVt+/GgsJ5RSIQ8vW3/wsB1i6TB55Qp//tgIJx8DG24KJjj5Y5Q:NEecLDpmTv3TtbQFpxu4KHk

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2