Extracted

• • Target

    Comprobante_swift_8676534657698632.exe

  • Size

    2.2MB

  • MD5

    20536d622fb95bee3d87757e3efa74e0

  • SHA1

    14e098d669f3f38235ad3152c0e5c45d20a827e0

  • SHA256

    a3a54505cb30e3eda94163b884011c9547bdf83ffdb0cd83dbff798c5345948f

  • SHA512

    3c3fae25813c46e8990c63af25b5d160e6db594d525bf3423e6e9f7985f5fc50853e6b122f2ddf185361d2a656ceb01a5475668ff838b68e87531eb2dbf6546a

  • SSDEEP

    49152:D3ASbdYAm4zEbdYAm4zWbdYAm4z23Ag3AWbdYAm4zSbdYAm4zO3AnMWc:rA4drWdr0drkASA0dr4dr8An

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2