Extracted

• • Target

    b30d15e1fd826e16c27bda3b36e7393bf2b0c007e3e3290a571ba3dd04c4c766

  • Size

    3.2MB

  • MD5

    a4188f15fc0369e5964b5e79e6b9583f

  • SHA1

    1803e2fbf8cc404650e03883248db932eeba5128

  • SHA256

    b30d15e1fd826e16c27bda3b36e7393bf2b0c007e3e3290a571ba3dd04c4c766

  • SHA512

    f99fe7718a6d5e0f11efe4220c02a1ace36eb910d6685530acb6e210c7c158bb839d2622bf56b7e389d7b08c7a13cb77a6529b2cb0121c1f8bcade276dd6ba34

  • SSDEEP

    12288:3J06HXD5uKDcWMXUoes0+2O0CHN1VBYT5QF:jXdDXMEFQ/HbV

  Score

  10^/10

  agentteslacollectioncredential_accessdefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2