Extracted

• • Target

    TT Swift Copy.exe

  • Size

    1.1MB

  • MD5

    6a33138b392e28378ad6abb6196e564a

  • SHA1

    d6ec4599b2b0f22d2c5f4f5f4e8c008cdabd455a

  • SHA256

    0d045677fbab19a80b17225c90ecca8fb973f67db71e7f86df8af5c25e0ac7a6

  • SHA512

    7622cee7c872448b5de318f3904855bc09b6287db70c3aa567c6e95e345b91670262a08fca16dad063c435c0b84d58ec50d891766091ac5cc5bf23a3d30fb78e

  • SSDEEP

    24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8al8YjQR/lx:dTvC/MTQYxsWR7als

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2