General
-
Target
SWIFT COPY FOR URGENT RESPONSE.exe
-
Size
539KB
-
Sample
211022-nbz4zscdcr
-
MD5
634657bd61352689f76e1ad691f569f8
-
SHA1
0c3a0c59080e59b29bee05fa871e77c5e5e221f1
-
SHA256
04c14c005ffff7fc3b47a608e6945310305d81958813b5e3552250e6823ff766
-
SHA512
22bac142024a844560a10f96c3297acf52c57bbd3a4b9cf34e6b80c78675b6b478402527692cd6f7dd27759ceec9b250813d7da4adf94b715fb4723f7b5b987a
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT COPY FOR URGENT RESPONSE.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
SWIFT COPY FOR URGENT RESPONSE.exe
Resource
win10-en-20210920
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.grodno.by - Port:
587 - Username:
vrkyl@mail.grodno.by - Password:
9qd8$2NonPD
Targets
-
-
Target
SWIFT COPY FOR URGENT RESPONSE.exe
-
Size
539KB
-
MD5
634657bd61352689f76e1ad691f569f8
-
SHA1
0c3a0c59080e59b29bee05fa871e77c5e5e221f1
-
SHA256
04c14c005ffff7fc3b47a608e6945310305d81958813b5e3552250e6823ff766
-
SHA512
22bac142024a844560a10f96c3297acf52c57bbd3a4b9cf34e6b80c78675b6b478402527692cd6f7dd27759ceec9b250813d7da4adf94b715fb4723f7b5b987a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-