General
-
Target
Swift Bank Copy #156065.pdf.zip
-
Size
477KB
-
Sample
210126-ltdmh5jr6n
-
MD5
57185da5b7e11698c450f6f13cfc06d6
-
SHA1
687c341cb309971997f7c1dd8346257b785a10ff
-
SHA256
0d989803ab5dcd272dcba7f79e19386a8ad264b0a2fddbc8ee03525a2eaef67d
-
SHA512
2d57a06c7835d56b601fd8f0a32ca431c96be9654b005880614a9f49932588aae19aa5dfe6d89d94f8aa8e9e8545dbb63b8cd63a2e231f576eb45ada0f89fd91
Static task
static1
Behavioral task
behavioral1
Sample
Swift Bank Copy #156065.pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Swift Bank Copy #156065.pdf.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.softg.com.ng/ - Port:
21 - Username:
[email protected] - Password:
wealth@123455@@
Targets
-
-
Target
Swift Bank Copy #156065.pdf.exe
-
Size
626KB
-
MD5
47096c8e597d10d44bcd609361e91469
-
SHA1
01fdd728dc4252fa5d68fe089adce4d71630ca58
-
SHA256
347d5e11054d6bd3be95cbef68ed59692ecc7479ca2361ab62ca23ce46d9c3ba
-
SHA512
f458c3cbd61aa0dfce006a2983380a517a87b84318635f9dd1d3d0668f34a28d61bc76e6fd24edd3a2131326b65eea147566345a958d917398be314ebeecdb77
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-