Overview

overview

10

Static

static

3

swifts.exe

windows7-x64

1

swifts.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    swifts.rar

  • Size

    127KB

  • Sample

    230825-hd5jlabc6w

  • MD5

    fd3d541227c5eea8c09a4a92a7c7b977

  • SHA1

    ce50e88c4a39ab5cc72b91dac4fc1ab8b99b9bd7

  • SHA256

    1e590665bde2c93081795c50d99673c6dc66c853e030382bdf027b30f85a4438

  • SHA512

    f56d85a65b2ca8dc6418b9c0ac98434999943b1a61a2055c4c85bf897cbd9b866d8ed0169f8dad2091a10532e0ea76fbb5b3aab7692fa40dd9ac2d0e54f239df

  • SSDEEP

    3072:coaCl40DMLxbFDzbaDTykXv81tAjfmlf1i5f:coa842MLxdmysv8LAjfA1ip

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      swifts.exe

    • Size

      292KB

    • MD5

      a1408c00b603d1ee2f7cfe890486dd05

    • SHA1

      21283ef8547df9dba3d209bfdaeefee482947f8f

    • SHA256

      2394bb95516f4c3daa7ece86414185bc1604e2850f51234bfacb64b404f1540b

    • SHA512

      e5a659c971a8d14d23e2a221404e9e26304c90292d8482e9b0e8dff3b8a3b411497094fcd102446ded1038cd88edc1eb425567f21a06877827a51d216ec6216f

    • SSDEEP

      6144:8V9z0b5E8Qg3RF8LrdB/HrSlUhQmYqHdSQNKALA88E58BOno:8V9z0m8Qg3Dydh807YyQQsALhJ

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks