General
-
Target
Swift Copy.rar
-
Size
381KB
-
Sample
210915-jelzbadbep
-
MD5
8435416df77922db23392c74adf82c59
-
SHA1
a8576d3b19a404273da58d4fc376f3f40b2d94d5
-
SHA256
28172cde8ad05da0ba1f2fb95134e7e2e81833efcca4d5897c6e96b888639894
-
SHA512
fd628dbbbeb4932c311ec9158a5194b140712157be30e28807db40c587ef7b93dbae0a6a1180eac5f8dc2b05e7228719811170fb485caa400764132fea46c30a
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v20210408
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.diva-italia.com - Port:
587 - Username:
[email protected] - Password:
rr.@%5LjgLz7
Targets
-
-
Target
Swift Copy.exe
-
Size
797KB
-
MD5
f4e3db4de0dfb56c9ce9a90a597914ad
-
SHA1
f14504642cff022e5edb1709bff3ba799f683c24
-
SHA256
7fcc227a274b3d5e1490799223181c246178a676b12de3c1c59d6a5d675febb7
-
SHA512
c5914f96debcecf426467a708ddd03e73e635d11c66aad9a7460c60a08f50e6aeed0d5ca7401527380c861ab398ca400b3d5622bf0c3b16acdf5427e03572269
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-