General
- Target Swift Copy.exe
- Size 961KB
- Sample201109-47pd6c964e
- SHA256 33e6e7a8f9bd94fa61311b96d6d87c77acae7ab7c42ef47e03be3a14ff7d492c
- MD5 9624b3fabceb26f8880b485905b3e214
- SHA1 178016a0632a88314640bf945da77528b788dcf1
- SHA512 38c43d79f677a250d64ceb82b2931fc35f99a2c9cc5b7a1463fe9657a0d375644c367bc58b0034ec005561ba0cfb2ffd547b462ba2bf9798d1050a8608443156
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.13texworkbd.com
-
Port
587
-
Username
-
Password
tex321
Targets
-
- Target Swift Copy.exe
- Size 961KB
- SHA256 33e6e7a8f9bd94fa61311b96d6d87c77acae7ab7c42ef47e03be3a14ff7d492c
- MD5 9624b3fabceb26f8880b485905b3e214
- SHA1 178016a0632a88314640bf945da77528b788dcf1
- SHA512 38c43d79f677a250d64ceb82b2931fc35f99a2c9cc5b7a1463fe9657a0d375644c367bc58b0034ec005561ba0cfb2ffd547b462ba2bf9798d1050a8608443156
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext