Extracted

• • Target
    Payment swift 1.exe
  • Size 1.1MB
  • SHA256 69aa5eec8198c9b95f9e6fbe8bee487ba430ba01a952009aef56805b0516cd83
  • MD5 54f752d80ed50bcb31bccb75eca3d965
  • SHA1 5b38c1c65f2ca9abf0d3af88ec16d53c91b1251e
  • SHA512 a45bd6607fe4d3579664d87f2de70ff17e9c66cebdaa23b529c22b573a85e15245f280e0d6ba3bc536b8a4629620cf7b296a53dab2a6704d659d61312f231f27
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2