Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.16701.7295.exe
  • Size 906KB
  • SHA256 6ae8091fb33773f96ccfe0cf41eae9bc2b95c3d1e04536039ff710633c09c14e
  • MD5 5c9488983dd183a023acb23f8f90687b
  • SHA1 2b3a86f49be705dcfc76fe0ea0825299c4cba86c
  • SHA512 94b24afd272a241e1bc1eef131db72f40b13f134c00e49fe569aed4710c6cbfb8eec998887d72c9dc39965673da72a3d7539fa8dd106fc8eb3642512afb29ee9
  • SSDEEP 24576:xKiXUoUbZ8Cn3V47r8ntiWHC+lFO/Hwgbq0:xK6LUbb47r88YCnd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2