General

  • Target

    Swift Copy_98754.zip

  • Size

    642KB

  • Sample

    240617-rq95aayaqq

  • MD5

    1ed47fbfc13d348980d42bdeb93612d2

  • SHA1

    c83385455d4c5d10f0f38c0fa08ec1c9bef85ff8

  • SHA256

    3958bde63ae20a22599c93c0b649e602e29cf30f61b9beb5bc664492ecea9e61

  • SHA512

    de8391bb0d98ecde484dd8bc30b3df36dcc5fe4104d3440b7d638116d912924e912d5cdade8c3e091ebc7f12569bec760a58d12b5a54ff5b3ca18b28000162e8

  • SSDEEP

    12288:H6uNjY2jJp0Biudl9h+SHVDH7C9en9196eBryFJgKRijVOwH6oq0Kh2T:HFpY2j7zW9lHV7qe9DMWFoq

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Swift Copy_98754.bat

    • Size

      683KB

    • MD5

      f32b5256aa4b8302a1c39a6c4480467e

    • SHA1

      b993653e7d5611c9d616a033f41b8129fd7937c0

    • SHA256

      7b22a626e9532c63ef451eab984601c0abf4248ff689624c3900581dbf6fd292

    • SHA512

      5b0732e9814687679889d1d3eb45383076bb525fa018672f4150885689f329a043150aff8e6b45577a03373fb6024de9d8234b5ad6f78112305e3892acd735eb

    • SSDEEP

      12288:mg82iNvFIsPAbp+Xt+SsEVNHxC9mHb190e3HybJgK9sjdOGzYArothvP:mF1DIKwYhsEjxqm7fUgVzYA+hX

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks