Overview

overview

10

Static

static

3

swift Copy.exe

windows7-x64

10

swift Copy.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    swift Copy.exe

  • Size

    506KB

  • Sample

    231011-rwrj5add2t

  • MD5

    7e6698e0d5ebc6fd5dff5c31a4af1ccf

  • SHA1

    af219f931555d2c14814df40f09c22e723934952

  • SHA256

    7c6290e3655029c44efe34d131645a716c892194cbe501514927d90350fee4f7

  • SHA512

    153f4890ecbd0d877f052971866d7c31fa9f7452c3e8a49a54e9f703ac8e0b06f51dbc52ca139d271b4855957b039547d016a37ba57401b242d72c6aba3f2639

  • SSDEEP

    12288:lqY4c2x4HIyUB8wGY1wLVCWk7LNCgQfcpT63ZMbcWw:hAOoeLwxChcpQO

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      swift Copy.exe

    • Size

      506KB

    • MD5

      7e6698e0d5ebc6fd5dff5c31a4af1ccf

    • SHA1

      af219f931555d2c14814df40f09c22e723934952

    • SHA256

      7c6290e3655029c44efe34d131645a716c892194cbe501514927d90350fee4f7

    • SHA512

      153f4890ecbd0d877f052971866d7c31fa9f7452c3e8a49a54e9f703ac8e0b06f51dbc52ca139d271b4855957b039547d016a37ba57401b242d72c6aba3f2639

    • SSDEEP

      12288:lqY4c2x4HIyUB8wGY1wLVCWk7LNCgQfcpT63ZMbcWw:hAOoeLwxChcpQO

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks