General
-
Target
Swiftsend-084_29042024_pdf_1.img
-
Size
1.2MB
-
Sample
240429-m21yjaha23
-
MD5
231ff6478230f8f2b28eecfec9ab901c
-
SHA1
f393456b1086bf9794f0c899333788b372da1322
-
SHA256
a6ebe5502b666ef55ff9dc168ce6c2e7cd72ee350b9d526713cef91b779afe9d
-
SHA512
edf5f4c4aea5488483f0a88d642f57263e578512b221b962b0b584ae59b603ea5743e45b9d1cf8ae084c1f9bd5bcfa91c912bc7c64fa33d4b2db72d3f7c43d98
-
SSDEEP
12288:44OB778QbN5vI3vIXpeFIJMTzfSmzQy3kymdJTRD1iKNDsreh5DSqiUNeGSggAU:FOBNN5QAZHJozSyC9PDX5WaXVU
Static task
static1
Behavioral task
behavioral1
Sample
cXPFfk0pBp7bEsb.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cXPFfk0pBp7bEsb.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kowalskiokna.pl - Port:
587 - Username:
[email protected] - Password:
artgeruhst75g - Email To:
[email protected]
Targets
-
-
Target
cXPFfk0pBp7bEsb.pif
-
Size
666KB
-
MD5
3e142ca68f08905cab743c39bf7f53ba
-
SHA1
65ff38bc2e98f89f01088e77f921230c02ed870d
-
SHA256
18f44886b9280533487b58a1feab7a3ebb463718417109643467315250b460b3
-
SHA512
afd533e46aa2cdc398d11c7422d7aff25dcafadcaf1b15084b5bec0c5890de2634ad09b8cca37d56e2692dfc63c5a96ad493fc719104fa610f2f36c3968df164
-
SSDEEP
12288:W4OB778QbN5vI3vIXpeFIJMTzfSmzQy3kymdJTRD1iKNDsreh5DSqiUNeGSggAU:TOBNN5QAZHJozSyC9PDX5WaXVU
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-