Extracted

Extracted

• • Target

    COPIA DE PAGO SWIFT.exe

  • Size

    650KB

  • MD5

    59a4f850157ca5ce9e8229510552d433

  • SHA1

    699d609cdc0b19fd1a83ae89ce5de8f01a853af8

  • SHA256

    d42df773a5031e58adb497c874fcf6d5b723aaf6eadd29283a834a08d9cf712d

  • SHA512

    669e3cfb38def3195307a496a3f5f998f9b4e04d6719b0c5f5ef5328169ff07e2bf9edec954bbd72a2e0ae8723167137a4d8daf1a45131e5c5794c3485d11680

  • SSDEEP

    12288:DaAvgzT370vptqK3DNol90+VSNXKY79gcr+zgP8hTnWIzLaMV:pxFov2XK89gc+TWXM

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2