Extracted

• • Target

    EXTRACTO BANCARIO.PDF.bat.exe

  • Size

    803KB

  • MD5

    7d131fe663e316890234bd712c7412a4

  • SHA1

    6cf5321a87b37bf68a1000cf6e2ea0ffff8cae71

  • SHA256

    c202341f6d54b9b2bc6ee1c53e51260a0adf11a81f9a509429f9039ef1d00600

  • SHA512

    471bd90a2b0ce8c629d709383d0353a8a5ae20ad24f890583eea65ef1207a693d8bfeb6901ed50ae9a95f6cc0db27caade1656fb182aaf4ae9659d6f33d96fa7

  • SSDEEP

    12288:9PKcWfPW1nUOMaq2LFbicxjMOJQVZq+F5S9vqI7a2CRbB:FWonUZaqMx2DvSxh7a31

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2