Overview

overview

10

Static

static

1

payment swift.exe

windows7-x64

10

payment swift.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment swift.r00

  • Size

    738KB

  • Sample

    230313-nlvl9aab67

  • MD5

    385cc3f155f279a40f1f0ac2b7988c13

  • SHA1

    e4cc4abf162180c0f3e8e5fd1c582a3280619a6f

  • SHA256

    733d9a1dd0a0d8ba860e9d4fe0edf2b6a33b373b20dc2187625c8f1b44ff7d51

  • SHA512

    4901319bbc579219dcdc9fc7fffb32fdcc2ab5fa5c7970227b592b943daacf3fab8afa2bba3407a3f5ca285d2239dbfe7923bc665189393e0d1dbdbb8412dc67

  • SSDEEP

    12288:4TLgFCjnoE1Ef0wY1csa71J1wWgZ2uXFoizom/dTwN9pm/gWwDikSK9EyY:Yfjno/PY1csoBwYuXFBhd3/gWsEkvY

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      payment swift.exe

    • Size

      1006KB

    • MD5

      feec3a5dfa497f7471804ee0550372cc

    • SHA1

      be16a6c79b2a5a35ea59fdb03d162bb3ae6fdfe0

    • SHA256

      ebfe3afe48dc47239d68700f74f01db8aef2b4c20f833178de5d55988d05a06a

    • SHA512

      ee67c4db25484aa728ea71ddca76b3fd0f1687990870d923a70b7919ac265200ea0be57f36c709c1fd004748536053ba6e4114f291be7960de5ad27140a2366b

    • SSDEEP

      12288:YKl1K8tUyZmMRxEy0gtHvOheuYorbLHqAIcv0y4PltHb1fLxddL/+u2KH7vrqFV1:1mhe0rbLHqvcFMbR57vrqFVae

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks