Extracted

• • Target

    bddee346a47d5cfbc48964020142db3cc659930094f46f8d63c072422499c7ed.exe

  • Size

    1.3MB

  • MD5

    6ac943b332528abd3402c0954145bf05

  • SHA1

    8a17715627e7017d2b45c09f4c978917880e2876

  • SHA256

    bddee346a47d5cfbc48964020142db3cc659930094f46f8d63c072422499c7ed

  • SHA512

    69fd5ffb81c100caab99b7b4e02de092666d4b591248ca6b604b3aedd9405c9a94d6167a9c22bddb82e036bd991ae0da4115fd9337604c6e8aac94a65a928fb7

  • SSDEEP

    24576:pE6VLynkgY8Lsz9JfAH4sx+dV8Iz7wMFaael:pEVY8We4ZeGfel

  Score

  10^/10

  agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2