General
-
Target
46de565bc252c8af4a2902066368849ef4b4fc1ffb523789d1526ba3b57cbcd1
-
Size
412KB
-
Sample
220521-axcc6adher
-
MD5
4b16ded68113e915c05f19beafadac62
-
SHA1
da138b8f9717ff27be90fd7b0b0b63b8e005fa62
-
SHA256
46de565bc252c8af4a2902066368849ef4b4fc1ffb523789d1526ba3b57cbcd1
-
SHA512
ddf368d8290e54c19abeface35dd14762f95b7c6959247c7df2825fca8fa126897f1ca76aef375a1133edd4117e798fcaff1b8487549cad9a799d3f19bb889e3
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT COPY.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SWIFT COPY.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.consolprinting.com - Port:
587 - Username:
[email protected] - Password:
fin@123
Targets
-
-
Target
SWIFT COPY.exe
-
Size
455KB
-
MD5
0565d209758be998f0eb7b764dfa2f21
-
SHA1
f1b35ab78a4829ad9e516ce1f0f68c9facaf358b
-
SHA256
c7c9c54e67529a2afb9a46a715a308bbb4089a90891062585ed22b08e0a2eb2f
-
SHA512
3b7ef62a7e93bba4a856319acdd311494889ce65359dcc071491ada0a05f3c1cf1fcbfbf10627c34bc6a373788f5f4cf80351834946362862900ff8ad75a62e1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-