Extracted

• • Target
    HSBC remittance Application.exe
  • Size 1.2MB
  • SHA256 cf02bb3aa058cc571d6c3368f98a96fefa3db05a813ea479d002edc1c3cbdb95
  • MD5 fe5efb8dae35b00ee308bcc28a895f7b
  • SHA1 ebb26f4663e4e8bb77ffc804d2c4b78b041edeba
  • SHA512 114003e0fdb780f36e5b95e166938e298c2dcbb0f76b47d9e3fabc49e55b0fb4f1a01def951d3374556e9f712e4434ddfb36bea85281d30802ffb9c986877894
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • AgentTesla Payload

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2