Extracted

• • Target
    HsbcpaymentSwift.com.exe
  • Size 647KB
  • SHA256 994e690703864150e91ac5f4d3cd5264d45e2ecc182424bd5285cbf935cb855d
  • MD5 3ab91ddca77430d4f4b1a811611bc622
  • SHA1 064a306cc2cddf4617d8c96d641bbcc11e90b8a0
  • SHA512 0d6fc9b2b5b505e17ac4885852fc6e39cd934e838ea2302f90cc09c1f9c3189b344d30ce5d56cee5e5cdb54f5aeed8472ecc2aab3422a78df1f454270ae70830
  • SSDEEP 12288:wlPloOJRYWq0WVVj9T/XSsGSol24i+okhoBfw4pPcyxCig1ewhc0IPg5jYvUyJ1p:O9oOJbjWfVzoV8kho64p0tIAhAg5+UUp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2