Extracted

Extracted

• • Target
    Swift output__688494949_PDF.exe
  • Size 652KB
  • SHA256 02a81f65ac8255add0150a5ebc1c6cd7df349b76ea4e9977b92c0062598aab70
  • MD5 ee04bd3df8f1ccfaff6c07e7f01040ea
  • SHA1 0659b33d931cd6b4f2c47b345c76964c4b9bec72
  • SHA512 25bc6863de95fa44d3e1f99727385934c2fceb726364e1d05ec117f5691a209c24bdc6dbc4e8eda29681161660735adb6750b0c28bf5ca5086170c8f49945a5a
  • SSDEEP 12288:58zS55mFzVy3HJZR/1JHy+5h1OeyUJtx33BI42Y7ETf3rp0vCW2y:5f55qJyXd1lOS13BILYQTv9BW2y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2