Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.6425.11525.exe
  • Size 687KB
  • SHA256 683021733dec8f81d58cfb993c6049c3f2b361b2bcb18046f02ab3211cf09e33
  • MD5 6e33871b6b50f21107d15138047c7990
  • SHA1 3aa40eb1347dd4484406f66f4d3ae9fd878ace75
  • SHA512 f5aed4277544e9bcf7ea11f7bcf4b2199f733d3a73a8898ccfb2e6f56204f98e826a2d3c78001c837b24ab64eaa993a4c4a2ad15e76ab75692a51734670cc4e1
  • SSDEEP 12288:WPuYd+V6b1momPZef6lraA/23boSN04xPpniMdY/7YXlpgmdXv3BPuYd+V6b:WPuYd+V6bIomxi6lOM23X0SA44mpvBPh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2