Extracted

• • Target

    EXTRACTO BANCARIO.PDF.bat.exe

  • Size

    379KB

  • MD5

    83feada9a3286828aa97e58014dd0750

  • SHA1

    86124ee8bb31d7bead2472234d4cafe8f19b5f25

  • SHA256

    9a128d7ba3cf8ed1f2aba6a777a44cf9580376cb8c2f44c5cc139fad08399f20

  • SHA512

    46b7eb3a31a68dd62218430da75c275bf6b025cab28365b9aff7bbdd6c44de76d713d8403eb0cce71b028bb8852a9c747170b871ed73ad8bdf63eace923f45fd

  • SSDEEP

    6144:NIw3EwpCSb69ZYNDuvH4zdEFa70ij9+ThwjKvpNwYH3JdPEnNi9eRDVFkC/TlO5u:gSbqaAoduu0BtWOpN7X/ERDJQ5ygA

  Score

  10^/10

  agentteslaguloadercollectiondiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2