Extracted

Extracted

• • Target
    PAYMENT_COPY_ HSBC BANK_Pdf.exe
  • Size 38KB
  • SHA256 f090ea218b1b9efedee6bae4665c1066649dc0fb94542467a56ae5a0a2c693e0
  • MD5 98c0e8ae038031c7f5f210119c1b0b36
  • SHA1 e63bb6d9ebe904e805f93f86dba97f6eeb6a5cef
  • SHA512 951259982fec7ccb4bcdaf4993e85f89ac041f28bd1150616ae59e983b91b5565610d379016a920df7465c7721c41e509802b298eab61e1446b9d47fc84b8e3d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslalimeratkeyloggerratspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2