Extracted

• • Target
    USD 993,338.02 SWIFT COPY.exe
  • Size 749KB
  • SHA256 dbb6f86569f351db8bb43e67f35f0178314707b1d085cc295f26ad56d6553cfe
  • MD5 0b9d9c103f27fa4ad25a7b55f9659bb2
  • SHA1 90b762c640c5f57483edfb708a203449c96a784c
  • SHA512 6b6d0e3a9e3babc6210615d82f249e8c0aadbceead3519c5c005076ecad5eae9aaa37210af3f298cc92957b74b435d2d6c1c41b15a9c1d74c4651712eb7c2ddb
  • SSDEEP 12288:NDdXtfET2s9tiUQseGPlrUXIYQ9Q7AQ3X9qMVMMDAhqaVzu4gIxkR:dd922s9tiURBrUXIYEQ7zncMnc02Rs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2