General
-
Target
SWIFT_COPY.daa
-
Size
698KB
-
Sample
210721-aefhtv5kdx
-
MD5
42e09c7162099d198dd3501c1aba1374
-
SHA1
f3179c60848e48adc4ada13dd743c959bf84fe63
-
SHA256
173823409774ef479a83ebbf296e78199779fd5641fd7a6ec7a1e0e0653b948a
-
SHA512
8b31d54ec59054c5de605961bfe6b60efae7d1b18ad178a1292d79c3a6a4c3cc740bdfe998efa490eb4af586a95e1734c5cd4f8b02182c2af734d20f67e8257d
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT_COPY.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SWIFT_COPY.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1437981864:AAFmXsejy8kUC_pj3BwrEvAeb2cv12XMVZI/sendDocument
Targets
-
-
Target
SWIFT_COPY.exe
-
Size
1.1MB
-
MD5
52862946ab473edb24310638e680f352
-
SHA1
19be1f62b40398ffb074397ef6fb797377228a6b
-
SHA256
8fcc1d5411f20280e9e142e535fb622aa55d6117030c1644032e5e2e709ef98a
-
SHA512
f4f1f0b784c3318932ce4eee4c1f5ec0f29d1adbe77b7986cd5276b29601a17bd683e7bc94ac626cea3a8733c58acbb06e6c07bb510f1634792ef0f3fbf03eb2
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-