Extracted

• • Target
    HSBC Payment Advice.img.exe
  • Size 749KB
  • SHA256 63eac58257e89ae7383cdfcddbf1209d18d9eda53fefe0b5a57de854649499d9
  • MD5 29f5ece6140932732a934fb693b77e84
  • SHA1 c7420e2c1365e60ab4dff96be2a4619dd5b71da3
  • SHA512 e6d119aa2f3b33beaedaa767074f0f5b7b0200907ddb6fab8a7e292edf55f4187642a468ec4f8750991c38dcd554f2b1aa08185c7f1418db57f895e8b0bb92a7
  • SSDEEP 12288:1edXtfETVJW54ALLNguUDAsUlQ5KRYvF6t11D1J2inUtGN1qaJru6f5WgR3OrZkR:cd92HZYLNgfDAZl4KAUtrminUg1qYrug
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2