Extracted

• • Target
    d447a9b9da2a9fb4603f41a9ba89829205636bb646f55665d25245bab3258568
  • Size 662KB
  • SHA256 d447a9b9da2a9fb4603f41a9ba89829205636bb646f55665d25245bab3258568
  • MD5 61cbf416918f184a55034f923f9f2b4d
  • SHA1 695622032fec47705a86ee9e15e12bdfa70084f6
  • SHA512 e8b849b34e01d3a5af33ae14b74495b114393875287ddfac1fda51351de5396a8a67b9e629f8828c97d4612f1db322b6e2dba26c174a747ec38ef2f15ce8c8ba
  • SSDEEP 12288:WYNKz+47K+xKJ6LYFKoJjCLkzRqJsi+9jCZpjMkVPOjrhfG/D:XNOK4KoyjSmRU3+9jKrPOjdfID
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2