General
-
Target
Payment swiftSOA.exe
-
Size
1.1MB
-
Sample
221004-t1ykcabec7
-
MD5
fbd05e26adad928bdd8cfde31cd1ef62
-
SHA1
359f4f64d05ea7f9f039d392da7d4a58831367d0
-
SHA256
e48102120cffcac97206067caee589ca90608b2a2f5ad44b71ab121bfbd05d17
-
SHA512
6badff7f04fa429ae0a9dd2ef93b99b6dd58d553561651dbc0c6c5b974000996fd24645cb92295a04ae62582e6cf1221b96f17c548c63a981210fd6be7c1bcd2
-
SSDEEP
24576:dDghp92/x/X/80zmYAxAhZcA9iisXS/bDwJef:B0M/1JmYAWY6CSPw
Static task
static1
Behavioral task
behavioral1
Sample
Payment swiftSOA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Payment swiftSOA.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
Payment swiftSOA.exe
-
Size
1.1MB
-
MD5
fbd05e26adad928bdd8cfde31cd1ef62
-
SHA1
359f4f64d05ea7f9f039d392da7d4a58831367d0
-
SHA256
e48102120cffcac97206067caee589ca90608b2a2f5ad44b71ab121bfbd05d17
-
SHA512
6badff7f04fa429ae0a9dd2ef93b99b6dd58d553561651dbc0c6c5b974000996fd24645cb92295a04ae62582e6cf1221b96f17c548c63a981210fd6be7c1bcd2
-
SSDEEP
24576:dDghp92/x/X/80zmYAxAhZcA9iisXS/bDwJef:B0M/1JmYAWY6CSPw
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-