Extracted

• • Target
    Bank Details_pdf.exe
  • Size 935KB
  • SHA256 031e9d43bb362aef89deff7c9fbc4d0cf3c4ed7f7eb8869c402a0a0f803feb08
  • MD5 c4144f485ace1895abe7bacf2cde2978
  • SHA1 27466be4b6a5cf39f0400a82edfd361c2ee666ee
  • SHA512 585b7caf7235d71d84fe41680036340af6590fd0428d2a5fa3095b6ee49b1bd30e61e76dfd454d5f5481c9aa4a3fb22bfc74a1b27ab72a81aabf2d87bda06acc
  • SSDEEP 12288:qtG7vV5zxPCRgqIYc1OWkXD5FqIGevvc2InWrQCUM+WB3m2jIAW6Yx2zO2WzU34V:Okv0GepcCUMFB2AWNx4OqoqVWZC/w
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2