General
-
Target
Swift Copy_98754.zip
-
Size
642KB
-
Sample
240617-rq95aayaqq
-
MD5
1ed47fbfc13d348980d42bdeb93612d2
-
SHA1
c83385455d4c5d10f0f38c0fa08ec1c9bef85ff8
-
SHA256
3958bde63ae20a22599c93c0b649e602e29cf30f61b9beb5bc664492ecea9e61
-
SHA512
de8391bb0d98ecde484dd8bc30b3df36dcc5fe4104d3440b7d638116d912924e912d5cdade8c3e091ebc7f12569bec760a58d12b5a54ff5b3ca18b28000162e8
-
SSDEEP
12288:H6uNjY2jJp0Biudl9h+SHVDH7C9en9196eBryFJgKRijVOwH6oq0Kh2T:HFpY2j7zW9lHV7qe9DMWFoq
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy_98754.exe
Resource
win7-20231129-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yubacuba.online - Port:
587 - Username:
[email protected] - Password:
vynKZC)6 - Email To:
[email protected]
Targets
-
-
Target
Swift Copy_98754.bat
-
Size
683KB
-
MD5
f32b5256aa4b8302a1c39a6c4480467e
-
SHA1
b993653e7d5611c9d616a033f41b8129fd7937c0
-
SHA256
7b22a626e9532c63ef451eab984601c0abf4248ff689624c3900581dbf6fd292
-
SHA512
5b0732e9814687679889d1d3eb45383076bb525fa018672f4150885689f329a043150aff8e6b45577a03373fb6024de9d8234b5ad6f78112305e3892acd735eb
-
SSDEEP
12288:mg82iNvFIsPAbp+Xt+SsEVNHxC9mHb190e3HybJgK9sjdOGzYArothvP:mF1DIKwYhsEjxqm7fUgVzYA+hX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-