Extracted

• • Target
    swift mitra_RFGH00867098.exe
  • Size 647KB
  • SHA256 13f2ab940f76d2f9e8d3819c19d9b68a9c9993bc9efc8035dd592d80496daa73
  • MD5 298c8e4ba10d49f6d8fbaf6b0cb47629
  • SHA1 af76795323fc1336cbda25dbd4e87e7a7a0f2cdc
  • SHA512 8baf11fd7ea96f0ed8f76fb7610790c0bde3146f17f3c26a9e9cc75bec29466daf977e04186b6cb2a416ad788f8a961478037ce8779a0ed4469f8278dc16a45f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2