Extracted

Extracted

• • Target
    SWIFT_DBS_9001_slip0034_USD53,944.05.exe
  • Size 661KB
  • SHA256 0a1ca91d04ec61da5e293f32d26ea3895d35575f1be5f699018ed683e9b097f1
  • MD5 5af7dc2440235ed7a2ad65fcfb6ced47
  • SHA1 4c9c9b9e4237e16a9085c3d6c560671b4056e21e
  • SHA512 93eb023e98c1da9d9462fe53acbbc93bedacbfed5ab03c3396584b794a6f4f417d42c877311a64984e332ffff9130d93c39d74df508215c1a73dccff64c49917
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2