Extracted

Extracted

• • Target
    SWIFT COPY.exe
  • Size 416KB
  • SHA256 6ba493ea1e159994234cd97a74f73df015437fecb04bf65c350d3d55f7940949
  • MD5 2b506cfd99e66483f273f28d46d96809
  • SHA1 0bbefb890d82e1f77f05facd69171b4613d71d0c
  • SHA512 30b64e4a8c788ecb202632b76881a81311a966a372370bd7df366d9d83ce233adb901c2a57b07b51a3183c8f4960b7b7b163bc5127da421ea0137f94a4eacea7
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2