Extracted

• • Target
    bank details.exe
  • Size 804KB
  • SHA256 255306dc51f8e03d60b15c31fcda56678224ff0e6781266a47aa71d5897429e7
  • MD5 aef42942c28ddb020f9694c8b701873f
  • SHA1 b2f5168edc9b1b9bbdbcc8089ae24dc852ed0080
  • SHA512 fcc62ed477853e90909f89612b2445afe4d90addc01fd90c2e4628d2dc4246649f37e07fac22bd958c8241004d39851a29dc4113da2b43f46e403a785225477c
  • SSDEEP 24576:ECTC3c6eWT56abnuA4y4pCmncHCHzs8j4gtY+VTqCo:Eyq56abnuNpCmncH81j4gtY+VTqp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2