Extracted

Extracted

• • Target

    swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe

  • Size

    11KB

  • MD5

    14fec5297bef8c5fa6d3f0f5934dea32

  • SHA1

    5549beb12b3635e878b174ae93d47a147e2f6d98

  • SHA256

    bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7

  • SHA512

    a7889770f7bed2ed2aff36c67cda577cd0ebc064c93532d425d0207bb60f55ee474d6e433402b86704d3f80e442209df53f0bd885d5fcd72b5b229ff5697fda6

  • SSDEEP

    192:cliHh1RDurJEC+88OSM4+pmqQcNM2YDM:cG1d2JEC+lKFI

  Score

  10^/10

  agentteslapurecryptercollectiondownloaderkeyloggerloaderpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2