Extracted

Extracted

• • Target
    Swift document.exe
  • Size 796KB
  • SHA256 2a00c8f1e74ad67fbd46cb64e3af0cbe77f56f99b7b2f8856703d4a0e2bfa7da
  • MD5 2006919c869f233b59879d4ddb77d318
  • SHA1 6403a73f995630e08772b73130623a7483aafb8b
  • SHA512 1c799327790568bd2386b1af65bdccc3824b80fe135f02f70d6df8ccbb6bad82177c33090e9ecaf2b87a37e2b07f565966d86ac5cfefdf35aaabec7672b2c709
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2