General
-
Target
3c26fcc5aee7f8e8601bab264178a7899f1d346af114a490764898fd14da11fa
-
Size
480KB
-
Sample
220521-azqcsseadp
-
MD5
369c5893e4da539be739fdda00c7c6f9
-
SHA1
e4b56c400059698c9a6c164f69f1e6332c487ea1
-
SHA256
3c26fcc5aee7f8e8601bab264178a7899f1d346af114a490764898fd14da11fa
-
SHA512
8aea9622e644a295eabb87b2103d09ac325096fadfbcfb46cd96d7cd6367d97f8c4b6e5528c5e1a525319f12efb56628dab51ba497c863df2937e9b8d7f76476
Static task
static1
Behavioral task
behavioral1
Sample
DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.rebu.co.rw/ - Port:
21 - Username:
[email protected] - Password:
o^Z0CIU?^yL2
Protocol: ftp- Host:
ftp://ftp.rebu.co.rw/ - Port:
21 - Username:
[email protected] - Password:
o^Z0CIU?^yL2
Extracted
Protocol: ftp- Host:
ftp.rebu.co.rw - Port:
21 - Username:
[email protected] - Password:
o^Z0CIU?^yL2
Targets
-
-
Target
DraftSwift copy hpSCAN 2207110 SWIFT CONFIRMATION 4657754 AGST INV CON 702.exe
-
Size
642KB
-
MD5
a56bb0b32e1cf8a6d446ef50b4b22d90
-
SHA1
458d0d9b4a210e34e958e2806700a5b177ddd660
-
SHA256
6de5c4939b3168487631c164ffc007b883acc005f689fb91951a06b92b06ea27
-
SHA512
09be55f3cc24410aaff2e100ce78bd61780f7eac62e310dcab23798cfcf13c316452749c759ab5fd7ca676158552089af82053e25426b67004f237987e281ed4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-