Extracted

• • Target

    SWIFT_EU.EXE

  • Size

    1013KB

  • MD5

    beb1cf169bf8b1f028cdbf6dd24ff43e

  • SHA1

    9534f9493c5b91fdaaa366aa6177b5154464ab53

  • SHA256

    95ecd7a290630296d2a9a4e0a4db58df0c29b1cd532be5f2dfe42fa92b82afed

  • SHA512

    ba553cbc367b83b201b4c3cf1c0104650d441bea5499956fefb2ac337d2b58b8c10b97f61d34243f7dcd1f600b41bfb4b1e7838bdd7020960348ab3dc88fdb1a

  • SSDEEP

    24576:vZfWvuqWEvfi64ZC1z0tFi6Ba/jzvY8M94pF:vY1vfqZ6zBQaPY8g

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2