General
-
Target
1444f6bad86c2ff79a4c3faeb4bdaadeaa64d311126f90bc0919a63d38a5f713
-
Size
395KB
-
Sample
220521-bb9xzaegar
-
MD5
c4276aead6620e7b9b0a7764177ac2cd
-
SHA1
e23322f88a3593aaf35b3f37a80433fc5b620afe
-
SHA256
1444f6bad86c2ff79a4c3faeb4bdaadeaa64d311126f90bc0919a63d38a5f713
-
SHA512
5ad0c46744189c8e01550410ba1947ada8928985a9398d71be5f226c7e7fc8d31c649d1d9751fc631a5a69ed76ad2d19894c2bcbedb2944639de005c2956b45d
Static task
static1
Behavioral task
behavioral1
Sample
Swift_098845.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Swift_098845.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
ImSCJnu6
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
ImSCJnu6
Targets
-
-
Target
Swift_098845.exe
-
Size
445KB
-
MD5
233b33cb478e8e8d1a75543f039024b8
-
SHA1
8d72b67ea52e0927d03d00d168bd8065fd5211c2
-
SHA256
dfca8cf09994229afec678b5c279d247e3e69c45f2878f816025b4933f3bc3b0
-
SHA512
c2acf510e40a9efefdc7c6ca1bf8574258c343adda592412c97946c33bcd02541a82bd682253e7d348ffe2ac7254c2db01d37c07609f354068fa8608e711d95e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-