General
-
Target
Swift copy_____________________________________________________________________________________________________.zip
-
Size
3KB
-
Sample
221002-pff3cagadm
-
MD5
a399af644e686fd644afee85cc0248e9
-
SHA1
7b4ffb82c1a6d0c0f22c472b981a82ced36b67f7
-
SHA256
5b1710a881dbccb8c6f164f8156158a7dca05ddca1ec3f0d42c8e6b038ece6c7
-
SHA512
88e7fa48945657ca0445c3bae526d1f3c6670e44b60b6f63b71d06a73d804c71785dc10607747a46cb0376f3cfea012882d5d8e155beea0b4cd426c01029a9c6
Static task
static1
Behavioral task
behavioral1
Sample
Swift copy_____________________________________________________________________________________________________.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Swift copy_____________________________________________________________________________________________________.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.lulifama.nl - Port:
587 - Username:
Sidney@lulifama.nl - Password:
5UbPvLRka8
Targets
-
-
Target
Swift copy_____________________________________________________________________________________________________.exe
-
Size
7KB
-
MD5
734be9eba345d418cb5effb5a5a3a04c
-
SHA1
c5ce9946d49a80e6185a67f1a12783678cd26af4
-
SHA256
5147e35d70e4613e480bf74e6663268efbea52c36ad13dcc6b78c09230791b24
-
SHA512
52b37d4e408df8d7a3d8688fec4c72082143458bcdaeb5cd1b2d5d4dd071e860f687870eb04a7b6e52b6425d786efac73b83ec3af49590eb05b68e2ca53b3db1
-
SSDEEP
96:XNt7571wlOoL0eoXl7m6LYH48Izly5fVeQ+zBJkrLYyyR7vMBzNt:nABoXlq6LYH45zcfz+F2IyejMD
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-