Extracted

• • Target
    SWIFT.exe
  • Size 476KB
  • SHA256 1d03a240bf6a1fc9d168fb662efefc36c878fc2c04ac07b9cd5673111702c252
  • MD5 8e4557cc88d4bd5cfb38e135fc184dcf
  • SHA1 7474438c4e5dc44ea4208c2ca1869156e797b149
  • SHA512 cfa9b832cf791af82bc8b24c6f609b44e59e4897049f0edf007d838fdf29f2271105fd5e46816cca71f9f8ef4f822e5daa21713e90316751e60eed68dc6c8c91
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2