Extracted

• • Target

    Transaction Receipt No.Swift03010599856670.exe

  • Size

    682KB

  • MD5

    54872ef77e1a4e1a4abccc89406fc8bf

  • SHA1

    d8ba982e3a936cced002ea1d7cb01d7de7c7957c

  • SHA256

    55cdb9093bbf832ee7f903cf8fa2ebcdf46c6c6867ac67e6f6fefa5553d8ed60

  • SHA512

    34905bcc4ee866ab45d850083aa9d8a11ed0bb2c2132660f3bb8c786c6d61f0d331881c611a963e063b811328377bf51b82b042753ae8a4c986992434420ba3a

  • SSDEEP

    12288:QfyCK2xrOoCwLrzOZAkDMKmjlnHqJKowsJs54mvXekpDwD:GyC5CIkA1HOK5sJW4m/v

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2