Overview

overview

10

Static

static

Swift Copy.pdf.exe

windows7_x64

10

Swift Copy.pdf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Swift Copy.pdf.exe

  • Size

    889KB

  • Sample

    210511-g1mr7r3qms

  • MD5

    dd2eb46743bf230998439673e3deba99

  • SHA1

    4871d34e0db77e32f627e74b92e9a9fbdef7a21a

  • SHA256

    ab417e35533138c082445ac1997401837c2be3af4527860f3b5c30dcabd325cb

  • SHA512

    9ddf626833dc5551ad869214590c23b11e8ca16bc37959608c960f283bfef027b451a8f7fabff9d0678d24cabf2de12a509c8a75e524643cf29faf2a1d275b33

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.saudimedlabexpo.com
  • Port:
    587
  • Username:
    info@saudimedlabexpo.com
  • Password:
    ]dTqP-]^T]Pt

Targets

    • Target

      Swift Copy.pdf.exe

    • Size

      889KB

    • MD5

      dd2eb46743bf230998439673e3deba99

    • SHA1

      4871d34e0db77e32f627e74b92e9a9fbdef7a21a

    • SHA256

      ab417e35533138c082445ac1997401837c2be3af4527860f3b5c30dcabd325cb

    • SHA512

      9ddf626833dc5551ad869214590c23b11e8ca16bc37959608c960f283bfef027b451a8f7fabff9d0678d24cabf2de12a509c8a75e524643cf29faf2a1d275b33

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks