General
-
Target
Swift Copy.bat
-
Size
979KB
-
Sample
241111-nd7a3sygne
-
MD5
411ad554068219f2ed0ce5e74f02d542
-
SHA1
917cc7780771e518c544338e24204471c54ec5fa
-
SHA256
59b03fee31c5c62caac3b05827d210553ce84a6e7c5ae43cb7d34f8242d9bae6
-
SHA512
6dbd1cffd8e580bb8737e00e6c85a63d8092edb2db2028d671241fc1223e58d254a13adfe1ee05574a98be8ec471566bba7d73e2d73d30ba1805d35615c3e090
-
SSDEEP
24576:i/Vwqfj3y6EQ4Dsv+G/9nRn0fyVPiDrNEtEBkvUEZmWwH+EP0R/tF25taZScLvci:0Vwqfj3y6EQ4Dsv+G/910fyVPiDrNEt1
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20240708-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Targets
-
-
Target
Swift Copy.bat
-
Size
979KB
-
MD5
411ad554068219f2ed0ce5e74f02d542
-
SHA1
917cc7780771e518c544338e24204471c54ec5fa
-
SHA256
59b03fee31c5c62caac3b05827d210553ce84a6e7c5ae43cb7d34f8242d9bae6
-
SHA512
6dbd1cffd8e580bb8737e00e6c85a63d8092edb2db2028d671241fc1223e58d254a13adfe1ee05574a98be8ec471566bba7d73e2d73d30ba1805d35615c3e090
-
SSDEEP
24576:i/Vwqfj3y6EQ4Dsv+G/9nRn0fyVPiDrNEtEBkvUEZmWwH+EP0R/tF25taZScLvci:0Vwqfj3y6EQ4Dsv+G/910fyVPiDrNEt1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Blocklisted process makes network request
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-