General
-
Target
Swift copy-MT103___________________________________________________________________________________________.zip
-
Size
8KB
-
Sample
221003-hysqjacfc8
-
MD5
52aa22ad708ef2b6f4101229df9116d1
-
SHA1
2b508ca38bf86f47992cd57e064348417d609866
-
SHA256
6fa8a72a574d0cfb439c054a4e9645078b61d8b62ad7da0d8f12864f32b01a11
-
SHA512
f81bd91830dcafdbfbee47d0d579e1cfab34d31a78b10cf684526240c746aef8d439cb8bf9e79684f3539e382bff13e48f7e9074ed0446948d7611d13642e188
-
SSDEEP
192:42Hs6II8C7v+uOHS5wkpBnwlu0ldyv5m7SNdZcnVA9j9+/W:4CIPCD9CS5XjRuQvU7sCVR+
Static task
static1
Behavioral task
behavioral1
Sample
Swift copy-MT103___________________________________________________________________________________________.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Swift copy-MT103___________________________________________________________________________________________.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.lulifama.nl - Port:
587 - Username:
Sidney@lulifama.nl - Password:
5UbPvLRka8
Targets
-
-
Target
Swift copy-MT103___________________________________________________________________________________________.exe
-
Size
15KB
-
MD5
d423232b851ec4d05782628579167877
-
SHA1
f379b79860c17a06ba21d2ce0a388ceb8cbeb206
-
SHA256
098c30f5be90148d97ead8f3c0aadafd8ac199d1e0207f33b7bbd203f9deff27
-
SHA512
5189f4370ac555983ec7949248bb2f7797c8fc2fffa530abca01699f27fa35ab356ce7b7366a66a33521c699491fdf44150a4e4aef8f757861e95031a10f82de
-
SSDEEP
192:aQvmrcXEyNpDjqqXtT0f4iYQ+Ilmqvpunc6nQuOKBq/qgUG2CVXhOF5I27:aqXEyNpHqatTKGWZpu5QuTU/qgJJAD
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-