Overview

overview

10

Static

static

3

Euro Swift...DF.scr

windows7-x64

10

Euro Swift...DF.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-BackdoorMSILAndromge_JC.7z

  • Size

    852KB

  • Sample

    230713-rppryshh81

  • MD5

    8b1c5c53b11b149b23a2f67d0136e88d

  • SHA1

    1063ed5f957a75f2cca79d5b6b37c43635e2117f

  • SHA256

    5ea1052b8b85c9e2989c300d33843e4b952305aa1f3f43d4ab0d0ed8b2191bc5

  • SHA512

    675c45c0a08a9e5259a967f5a084db77c8d599e296ef6703defd1d34e4cf854fa6ce1bc956a5324994db3fc12bdf7b38069c1d9da89e7e4dc84724285b7bb8b4

  • SSDEEP

    24576:EBys3Da9sv3bafUcRN7KQe86SpYIHVPFO9Z:EL3DaybHwN7KB8VF1PAZ

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Euro Swift Copy·PDF.scr

    • Size

      1.3MB

    • MD5

      b67a90c8381e471791cc4e5f7e43829f

    • SHA1

      7ecac5583356989ae599e6a1a096c791b350e7c7

    • SHA256

      6e19455a9618b20fae8404a9b3c9f4f37d2b2cf032faf61d3837b59bf9497666

    • SHA512

      04a8f5ca1793c2bc35451ab617416d2b93a8be3471bb73305d359c96b818b2265e702e37425ee2aafee5e3132cd1a01e235df1174bdee23e3a2b1e694be6d555

    • SSDEEP

      24576:zCdQy7r3oUV2nJEFQ/S26klFhX1Ar7QemnokIUSSm0U:eXgKF4S2z/XOed

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks