General
-
Target
Swift Copy.exe
-
Size
402KB
-
Sample
210129-le87885l5s
-
MD5
5a9debb5fe8c0e93ae9e02f10cecc58a
-
SHA1
b75d715d1a80786b4e1071d6b1e4b3b3d815b815
-
SHA256
eb805d5030c861fec54249670b911ad69bd6339de5e4deecbaf051633333ccb5
-
SHA512
a423ab64388fc2e9da2b78e08940c006f68c6678436ab031761201ba5384df3f33eca0150587298a40e0cd80e7c8223167f4483b46f9b82f5afe4fa360701705
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.kpce-co.com - Port:
587 - Username:
[email protected] - Password:
l9#Qg$:nwmC3
Targets
-
-
Target
Swift Copy.exe
-
Size
402KB
-
MD5
5a9debb5fe8c0e93ae9e02f10cecc58a
-
SHA1
b75d715d1a80786b4e1071d6b1e4b3b3d815b815
-
SHA256
eb805d5030c861fec54249670b911ad69bd6339de5e4deecbaf051633333ccb5
-
SHA512
a423ab64388fc2e9da2b78e08940c006f68c6678436ab031761201ba5384df3f33eca0150587298a40e0cd80e7c8223167f4483b46f9b82f5afe4fa360701705
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-