Extracted

• • Target
    BANK DETAILS.exe
  • Size 832KB
  • SHA256 faca737d4aa23d55f6d5e25ce2b47f8f5060b8b62aa472073de85c50a21347d2
  • MD5 7dace3f0331ea493fb87e73b458187d1
  • SHA1 826c4cc507cb0af478399eae982119a7733df296
  • SHA512 09c5d58dc0113c0733c9a84419c5f03b0d6fef1ceb17c83d79f6aafbe0352e06f624034908a48ee38f8872c38186e8786a60ef6ae671e59c68b34567b6cc3ac9
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2