General
-
Target
SWIFT COPY FOR URGENT RESPONSE.exe
-
Size
565KB
-
Sample
211021-qjybgaada4
-
MD5
baf09af5acba50588177f4f11972108c
-
SHA1
69e2fa2f2d785dd341586cd1d014d3df9536db63
-
SHA256
f8998c25565dd6aca2fa3cb8d2ffbb3253ed22de1b230b07bf2df48a286d8ec3
-
SHA512
a64bc3d60a0ecfce35d8d7b18e95cf35ed4658c5ad5c9719b90ba5104bc57b15f2f3199151b8f776ad0e86d1527e9513264677eb085222c09f67efe52eb52a31
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT COPY FOR URGENT RESPONSE.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
SWIFT COPY FOR URGENT RESPONSE.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.grodno.by - Port:
587 - Username:
vrkyl@mail.grodno.by - Password:
9qd8$2NonPD
Targets
-
-
Target
SWIFT COPY FOR URGENT RESPONSE.exe
-
Size
565KB
-
MD5
baf09af5acba50588177f4f11972108c
-
SHA1
69e2fa2f2d785dd341586cd1d014d3df9536db63
-
SHA256
f8998c25565dd6aca2fa3cb8d2ffbb3253ed22de1b230b07bf2df48a286d8ec3
-
SHA512
a64bc3d60a0ecfce35d8d7b18e95cf35ed4658c5ad5c9719b90ba5104bc57b15f2f3199151b8f776ad0e86d1527e9513264677eb085222c09f67efe52eb52a31
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-