Extracted

• • Target
    Swift_HSBC_0099087645PDF.exe
  • Size 559KB
  • SHA256 d5736edad6679da3cee555c2ae3a023f1ca86f6ed4a7cf37832a0b352225fad1
  • MD5 6093a800070142d2e434095ec55af023
  • SHA1 ca8a74929b31abc27d06180fdf862689d0c6acd6
  • SHA512 01ae9c423a8e3850d963299cba53a37a74758dc4bbaf2986015ba2210a434b7a05e4ef68dfb751063ca51307a59dd00c33fc30f99463dd30b8b15ba62bef8c4e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2