Extracted

• • Target

    3ad17ee1bc48c71fbf42f8cc88856677bcf6c4755c4a3f79f62fdd93edd9e7a0.exe

  • Size

    523KB

  • MD5

    cf1cae9cbc07203bf45484c1824190fb

  • SHA1

    946345a623ac1f27159b2f8a03eff877bdc7a60e

  • SHA256

    3ad17ee1bc48c71fbf42f8cc88856677bcf6c4755c4a3f79f62fdd93edd9e7a0

  • SHA512

    bf63b5c5f76b2766cdc73b12953dbdb714429201682c1cb6b5504eae427249ae12b8801d1b562233a0bcead952786c77511f84a828f65acf8921390ff64b56c8

  • SSDEEP

    12288:zZUi2iNm85TyKV9njG/DT7sqzm0hWXFIbC5XMCAdVrWKIU14:zZUi10I2ctK/H7sqdyQT1rWnw4

  Score

  10^/10

  agenttesladiscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2