Extracted

Extracted

• • Target

    CWXMF230300599.exe

  • Size

    689KB

  • MD5

    eae8d9e270bc65f3cfcc90b97083d4b9

  • SHA1

    c0eed19977aa5f6100804d2e431d6bb5bef69daa

  • SHA256

    67cc89f84a6e88f1b74bce29e680fb2e64d1a0104330ea9dd1cf5770d63cf436

  • SHA512

    c22768233177eebf87a2991067fe76816d39416c8d9cc764e6424e90ebf00a832c35455981e2884a61aa748afd50a18d0d1881eb06f47bc473f4ede44fc429e8

  • SSDEEP

    12288:sHTBGjiqmtBWT6HTEiGmmzSNdP6BeuboLRMQeIgXZQR:uOiqmtB6GEiLm6658LiQhaZ6

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2