Extracted

• • Target
    4409RI100080 SWIFTMSG.TXT.exe
  • Size 458KB
  • SHA256 f07fc5f31e955fb3c7fc9d9c5a7eff013b987916aa18c60c1b3ff80db344c9ab
  • MD5 ee8a0fc4071663b4c7f8524a896b302a
  • SHA1 27b2da6630e2a684379ef8c16568857070a2a15c
  • SHA512 a6c17a2f0046c4c8a36613f345a881c1692caec5e39b23f0aa4f8de0759cf4184a47a51d70e215021e90db64fb568c02cd9bd56961a5b390cbd56fcb8c410e58
  • MD5 SHA1 SHA512

  Score

  10^/10

  evasionagentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2