Extracted

• • Target

    SecuriteInfo.com.Win64.PWSX-gen.8563.27113.exe

  • Size

    3.3MB

  • MD5

    e5b1971ffaf9640dc601cb3da3e5bc82

  • SHA1

    5f2fa7104c3ca939d1666012560e5ffd7438051d

  • SHA256

    17c5a2879cd2f4277cc00047e8f20c39fe9f8849bdf7bb21e0b272309d7ef50b

  • SHA512

    1bd5e303d3870f654137f02999d0120320788d04902de498ffe4d00c5e05d1ce049f013ce5e9452102035da7a59ffb0da90ba6a5604f2a3be1dd864ad9d3b930

  • SSDEEP

    12288:+8AQmTfd4CsmmkDXf9PA4XcuMqlXuXTwA+ebOIuJSto:+8AQmTfdh/VeFp+e6TJS

  Score

  10^/10

  agentteslacollectionevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2