General
-
Target
0c302b97463303bba1bef43aff1a139098d502f4f11d26b2b30c9fc16fb76106
-
Size
1.2MB
-
Sample
220521-byjz3afgcq
-
MD5
1a4b17ee90530873941aff5d9ed2cf00
-
SHA1
4d4597b22c3a540b486e7a9a014a4d83ce875554
-
SHA256
0c302b97463303bba1bef43aff1a139098d502f4f11d26b2b30c9fc16fb76106
-
SHA512
d6929eaffc971c6f203ff5506c46943a00ed91b98ca4e6877f48712863fc81b109bae1d196fe99205939465805c069b30ce75c4289df080b1fab85a89dd8e4da
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT_01.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SWIFT_01.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ltepl.com - Port:
587 - Username:
[email protected] - Password:
!hB@L017@LTE
Targets
-
-
Target
SWIFT_01.EXE
-
Size
612KB
-
MD5
5ffa513ea6a5ee45e2a25292e220c652
-
SHA1
4747c154f9ae81e0a3e489f0e55f44e95c09520f
-
SHA256
2645cf7e9731a0340c150e0beadaf8dc22fdd0bc5edc2e642c27b438300b3a92
-
SHA512
f93bfcb15bb53049618084888e6a7a8e4ed6f86d5e2147262b12b08fcc8e7584771eacf04dc6c3fdcb0646e376141136e3eba6c79faa38cfd15187e83ee1d3db
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-