Extracted

• • Target

    Swift copy_____________________________________________________________________________________________________.exe

  • Size

    7KB

  • MD5

    734be9eba345d418cb5effb5a5a3a04c

  • SHA1

    c5ce9946d49a80e6185a67f1a12783678cd26af4

  • SHA256

    5147e35d70e4613e480bf74e6663268efbea52c36ad13dcc6b78c09230791b24

  • SHA512

    52b37d4e408df8d7a3d8688fec4c72082143458bcdaeb5cd1b2d5d4dd071e860f687870eb04a7b6e52b6425d786efac73b83ec3af49590eb05b68e2ca53b3db1

  • SSDEEP

    96:XNt7571wlOoL0eoXl7m6LYH48Izly5fVeQ+zBJkrLYyyR7vMBzNt:nABoXlq6LYH45zcfz+F2IyejMD

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2