General
-
Target
ade2854cf9442c96d447a57403f756707a5cce5ff379d3c692a7becb1f575046
-
Size
317KB
-
Sample
220520-3z5fyahgg7
-
MD5
672da6fda251c7d8189b20679d26e450
-
SHA1
d180f9d53be97090cfdc9e03d1bf960d4844a039
-
SHA256
ade2854cf9442c96d447a57403f756707a5cce5ff379d3c692a7becb1f575046
-
SHA512
1f4043b05b9bd4daf05e03a14c7fb3d35d0b40571195df299ce1a159de41923fe1fec35b34741c4eeb7f429e23170254f984d03edbc13600ab4d1ee21556224a
Static task
static1
Behavioral task
behavioral1
Sample
Swift copy.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Swift copy.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
JEHOVAH8899
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
JEHOVAH8899
Targets
-
-
Target
Swift copy.exe
-
Size
509KB
-
MD5
8f482dd2657a2bd05f81cfa17aeea131
-
SHA1
3912d4be49f19f3b322d5915047f9151a0a4ff49
-
SHA256
a157b217186051da0622b17c6ddf722769c60887266c8e439d84514a4ce858ba
-
SHA512
80e85e2c893d4d5376e4a4182fdcf159541d4766d9828e3e1a88b6edbe0f639777c454e9f97d40593dc27a20b3ae153f262aa4efeec9c6f66ea67d12956bb434
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-