General

  • Target

    swif.exe

  • Size

    440KB

  • Sample

    211019-zd7sdsgdb8

  • MD5

    ceae6fe1fbf29a7edc7e4bdc0fa1e90d

  • SHA1

    0ce8bcf3606890d226454341edd131f025f11d3f

  • SHA256

    e6ecdaef474a3ea4407eae99ea219723f686756f42cf6bcff199f34677be8a20

  • SHA512

    50b3189b566cf32657510e9b67b90c4cc25e1ec107fdb6bf268bc5b333839dc854a8993ebb3f1a8457a80a89234931e09dbf11e20cc1cd4b0fbdcc709a222c0e

Malware Config

Targets

    • Target

      swif.exe

    • Size

      440KB

    • MD5

      ceae6fe1fbf29a7edc7e4bdc0fa1e90d

    • SHA1

      0ce8bcf3606890d226454341edd131f025f11d3f

    • SHA256

      e6ecdaef474a3ea4407eae99ea219723f686756f42cf6bcff199f34677be8a20

    • SHA512

      50b3189b566cf32657510e9b67b90c4cc25e1ec107fdb6bf268bc5b333839dc854a8993ebb3f1a8457a80a89234931e09dbf11e20cc1cd4b0fbdcc709a222c0e

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks