General
- Target Swift Copy.exe
- Size 369KB
- Sample220815-nnvp2adaa6
- SHA256 f4d7b271af8222a8b77800e2a7010665ca3333295ccdb0fa8c484935d8c26335
- MD5 547c00125fc68d3b173ee89800ffc69b
- SHA1 b550e4145ca4aee62f74a0f2c5c8d68b2dd8c852
- SHA512 547408bce8ecea603d2b58fdf0bc54a20cd048baa088f69318d9024d66c4f373bfb9ae9bbef96bb4da51f01954489aa49693f17505fae7bb5dba53e07ff75624
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20220812-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v2004-20220812-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.mayhighfilms.com
-
Port
587
-
Username
-
Password
#Mayhighfilms
-
Email to
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.mayhighfilms.com
-
Port
587
-
Username
-
Password
#Mayhighfilms
Targets
-
- Target Swift Copy.exe
- Size 369KB
- SHA256 f4d7b271af8222a8b77800e2a7010665ca3333295ccdb0fa8c484935d8c26335
- MD5 547c00125fc68d3b173ee89800ffc69b
- SHA1 b550e4145ca4aee62f74a0f2c5c8d68b2dd8c852
- SHA512 547408bce8ecea603d2b58fdf0bc54a20cd048baa088f69318d9024d66c4f373bfb9ae9bbef96bb4da51f01954489aa49693f17505fae7bb5dba53e07ff75624
- MD5 SHA1 SHA512
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext