General
-
Target
TT_Swift_Copy.exe
-
Size
840KB
-
Sample
200708-g9j6nyfy12
-
MD5
51e3866b7d82195b81c27f923a7a5de9
-
SHA1
537c2600b5e907a6c27fdb1790b0c9e9d3116dd8
-
SHA256
1d2b14679a8794ddfca09b38774d9b8f432955eb2d6a14cc45c79b009d5077f8
-
SHA512
bf053907af1a91ecd4b1acd90f7feabe336fea44de9c7ad1a3dffc937b715fb5aa41da6736e46f4fd5f9415014869e3ed7082cae899fa8687ca832d41032d39a
Static task
static1
Behavioral task
behavioral1
Sample
TT_Swift_Copy.exe
Resource
win7
Behavioral task
behavioral2
Sample
TT_Swift_Copy.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
96965648
Targets
-
-
Target
TT_Swift_Copy.exe
-
Size
840KB
-
MD5
51e3866b7d82195b81c27f923a7a5de9
-
SHA1
537c2600b5e907a6c27fdb1790b0c9e9d3116dd8
-
SHA256
1d2b14679a8794ddfca09b38774d9b8f432955eb2d6a14cc45c79b009d5077f8
-
SHA512
bf053907af1a91ecd4b1acd90f7feabe336fea44de9c7ad1a3dffc937b715fb5aa41da6736e46f4fd5f9415014869e3ed7082cae899fa8687ca832d41032d39a
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-