Extracted

• • Target
    Bank Details.exe
  • Size 1.2MB
  • SHA256 0ca1f0a08b7a21079683beeaf8bfa86df3d396b8d7a0cade52e963b78bd9a7e3
  • MD5 6cc3fa5028ea0d1ba0c8f77d6fc0aff8
  • SHA1 8d806b094319a34473fb196bdf6af7add10dd8ac
  • SHA512 d3da0729b2c8ffd1257b5df0ef3e86f6055eef96cedbc48f3c9d892b276983916772322d407df6c80821319dfa65ad15c981f3d40e06a71e33331899005171ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  evasionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2