Extracted

• • Target

    8bc8b49458d5fb7d228bb2541189e2de7122f6819087c7eb00fcf215bdcaf7c7

  • Size

    455KB

  • MD5

    3cb174f4e9e4b44c8360597692bc259c

  • SHA1

    723d56d0072e09eafe242c050a9f0cc422b92ee0

  • SHA256

    8bc8b49458d5fb7d228bb2541189e2de7122f6819087c7eb00fcf215bdcaf7c7

  • SHA512

    00a382f11ff2ceaf7de3555597a95a1faa8a2cb78f7c8fe461db1dee9f1c93ad4a2e47bc071ae5d819006246e62405d2f1f153457bab84bf5f1cb748e5d7075c

  • SSDEEP

    6144:bdcZ430nBPewKZ50Qg/gypH8sh1CHreDbUL4Vp/RX6F/937MwY0uUYY0SA:bdKswKZCQgoKHvCreDbULORqZtMwYb7

  Score

  10^/10

  agenttesladiscoveryevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2