Extracted

• • Target
    swift copy $37,000.00.exe
  • Size 543KB
  • SHA256 02fa0fa7b89d8ad41c32e0613ef1bb1c38d9b93ea98d9295b7d61c2ca400a300
  • MD5 a99818b6c355b5cbd62eb74d802e0f5c
  • SHA1 e23ff2e7bb3d481b90f8682e9a152dc86423d87e
  • SHA512 a44966c8eac0a6972799672d3deec125c0e55abd9cfd28311d2030c005b46b319e80159d58038d4b511f33841bcf6903fe64b8bba3227ad670cd079d4cfcb629
  • SSDEEP 12288:2riQBsuvXMx6Jb6zL0gciYe7WzpiLqh3zFh:aSuv8xQ66kW9iLqhjF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2