Edit tour

Windows Analysis Report
payment swift.exe

Overview

General Information

Sample Name:	payment swift.exe
Analysis ID:	755998
MD5:	0eb99950c8a30fee01ebfdaa33498b22
SHA1:	54557815e576ac70fcbcdfcb6765f3d2a2dff507
SHA256:	469dae2eed97bbfe08ae548308e77aedcd0795fb4b2b1abcdd1a0315fe1ff216
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Found evasive API chain (may stop execution after accessing registry keys)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

payment swift.exe (PID: 3100 cmdline: C:\Users\user\Desktop\payment swift.exe MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

payment swift.exe (PID: 4460 cmdline: C:\Users\user\Desktop\payment swift.exe MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

WdFVsOe.exe (PID: 2460 cmdline: "C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe" MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

WdFVsOe.exe (PID: 4768 cmdline: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

WdFVsOe.exe (PID: 5992 cmdline: "C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe" MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

WdFVsOe.exe (PID: 972 cmdline: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

WdFVsOe.exe (PID: 1276 cmdline: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe MD5: 0EB99950C8A30FEE01EBFDAA33498B22)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "host39.registrar-servers.com", "Username": "dickson@potashin.us", "Password": "*r4} Du LH  n87G"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.313645910.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000000.313645910.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000000.313645910.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31d17:$a13: get_DnsResolver 0x30424:$a20: get_LastAccessed 0x32745:$a27: set_InternalServerPort 0x32a7a:$a30: set_GuidMasterKey 0x30536:$a33: get_Clipboard 0x30544:$a34: get_Keyboard 0x31911:$a35: get_ShiftKeyDown 0x31922:$a36: get_AltKeyDown 0x30551:$a37: get_Password 0x3106c:$a38: get_PasswordHash 0x32179:$a39: get_DefaultCredentials
00000000.00000002.315807649.00000000030D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.360649511.0000000002655000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.570872866.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.570872866.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.571356587.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.571356587.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.318247702.000000000427E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.318247702.000000000427E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.318247702.000000000427E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x146157:$a13: get_DnsResolver 0x17c977:$a13: get_DnsResolver 0x1b2f97:$a13: get_DnsResolver 0x144864:$a20: get_LastAccessed 0x17b084:$a20: get_LastAccessed 0x1b16a4:$a20: get_LastAccessed 0x146b85:$a27: set_InternalServerPort 0x17d3a5:$a27: set_InternalServerPort 0x1b39c5:$a27: set_InternalServerPort 0x146eba:$a30: set_GuidMasterKey 0x17d6da:$a30: set_GuidMasterKey 0x1b3cfa:$a30: set_GuidMasterKey 0x144976:$a33: get_Clipboard 0x17b196:$a33: get_Clipboard 0x1b17b6:$a33: get_Clipboard 0x144984:$a34: get_Keyboard 0x17b1a4:$a34: get_Keyboard 0x1b17c4:$a34: get_Keyboard 0x145d51:$a35: get_ShiftKeyDown 0x17c571:$a35: get_ShiftKeyDown 0x1b2b91:$a35: get_ShiftKeyDown
00000002.00000002.360150897.00000000025A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.569999847.0000000002841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.569999847.0000000002841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.315641125.0000000003021000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: payment swift.exe PID: 3100	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: payment swift.exe PID: 3100	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: payment swift.exe PID: 3100	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x5f4b6:$a13: get_DnsResolver 0x5e4a1:$a20: get_LastAccessed 0x5fb58:$a27: set_InternalServerPort 0x5fd3f:$a30: set_GuidMasterKey 0x5e587:$a33: get_Clipboard 0x5e595:$a34: get_Keyboard 0x5f233:$a35: get_ShiftKeyDown 0x5f244:$a36: get_AltKeyDown 0x5e5a2:$a37: get_Password 0x5ecb9:$a38: get_PasswordHash 0x5f776:$a39: get_DefaultCredentials
Process Memory Space: payment swift.exe PID: 4460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: payment swift.exe PID: 4460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: payment swift.exe PID: 4460	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x5dc7:$a13: get_DnsResolver 0x4734:$a20: get_LastAccessed 0x67a4:$a27: set_InternalServerPort 0x6a0b:$a30: set_GuidMasterKey 0x482f:$a33: get_Clipboard 0x483d:$a34: get_Keyboard 0x5a5d:$a35: get_ShiftKeyDown 0x5a6e:$a36: get_AltKeyDown 0x484a:$a37: get_Password 0x52c1:$a38: get_PasswordHash 0x61fd:$a39: get_DefaultCredentials
Process Memory Space: WdFVsOe.exe PID: 2460	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: WdFVsOe.exe PID: 4768	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: WdFVsOe.exe PID: 4768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: WdFVsOe.exe PID: 1276	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: WdFVsOe.exe PID: 1276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.WdFVsOe.exe.25e063c.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
2.2.WdFVsOe.exe.25e063c.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xcfea:$v1: SbieDll.dll 0xd004:$v2: USER 0xd010:$v3: SANDBOX 0xd022:$v4: VIRUS 0xd072:$v4: VIRUS 0xd030:$v5: MALWARE 0xd042:$v6: SCHMIDTI 0xd056:$v7: CURRENTUSER
0.2.payment swift.exe.4392240.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.4392240.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.4392240.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c56:$s10: logins 0x326d0:$s11: credential 0x2e936:$g1: get_Clipboard 0x2e944:$g2: get_Keyboard 0x2e951:$g3: get_Password 0x2fd01:$g4: get_CtrlKeyDown 0x2fd11:$g5: get_ShiftKeyDown 0x2fd22:$g6: get_AltKeyDown
0.2.payment swift.exe.4392240.6.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30117:$a13: get_DnsResolver 0x2e824:$a20: get_LastAccessed 0x30b45:$a27: set_InternalServerPort 0x30e7a:$a30: set_GuidMasterKey 0x2e936:$a33: get_Clipboard 0x2e944:$a34: get_Keyboard 0x2fd11:$a35: get_ShiftKeyDown 0x2fd22:$a36: get_AltKeyDown 0x2e951:$a37: get_Password 0x2f46c:$a38: get_PasswordHash 0x30579:$a39: get_DefaultCredentials
0.2.payment swift.exe.30605f0.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.payment swift.exe.30605f0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xcfea:$v1: SbieDll.dll 0xd004:$v2: USER 0xd010:$v3: SANDBOX 0xd022:$v4: VIRUS 0xd072:$v4: VIRUS 0xd030:$v5: MALWARE 0xd042:$v6: SCHMIDTI 0xd056:$v7: CURRENTUSER
1.0.payment swift.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.0.payment swift.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.0.payment swift.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x34a56:$s10: logins 0x344d0:$s11: credential 0x30736:$g1: get_Clipboard 0x30744:$g2: get_Keyboard 0x30751:$g3: get_Password 0x31b01:$g4: get_CtrlKeyDown 0x31b11:$g5: get_ShiftKeyDown 0x31b22:$g6: get_AltKeyDown
1.0.payment swift.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31f17:$a13: get_DnsResolver 0x30624:$a20: get_LastAccessed 0x32945:$a27: set_InternalServerPort 0x32c7a:$a30: set_GuidMasterKey 0x30736:$a33: get_Clipboard 0x30744:$a34: get_Keyboard 0x31b11:$a35: get_ShiftKeyDown 0x31b22:$a36: get_AltKeyDown 0x30751:$a37: get_Password 0x3126c:$a38: get_PasswordHash 0x32379:$a39: get_DefaultCredentials
0.2.payment swift.exe.42fe420.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.42fe420.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.42fe420.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xc8876:$s10: logins 0xff096:$s10: logins 0x1356b6:$s10: logins 0xc82f0:$s11: credential 0xfeb10:$s11: credential 0x135130:$s11: credential 0xc4556:$g1: get_Clipboard 0xfad76:$g1: get_Clipboard 0x131396:$g1: get_Clipboard 0xc4564:$g2: get_Keyboard 0xfad84:$g2: get_Keyboard 0x1313a4:$g2: get_Keyboard 0xc4571:$g3: get_Password 0xfad91:$g3: get_Password 0x1313b1:$g3: get_Password 0xc5921:$g4: get_CtrlKeyDown 0xfc141:$g4: get_CtrlKeyDown 0x132761:$g4: get_CtrlKeyDown 0xc5931:$g5: get_ShiftKeyDown 0xfc151:$g5: get_ShiftKeyDown 0x132771:$g5: get_ShiftKeyDown
0.2.payment swift.exe.42fe420.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x3539b:$s1: file:/// 0x352ab:$s2: {11111-22222-10009-11112} 0x3532b:$s3: {11111-22222-50001-00000} 0x344dd:$s4: get_Module 0x34858:$s5: Reverse 0xc4b07:$s5: Reverse 0xfb327:$s5: Reverse 0x131947:$s5: Reverse 0x2fc71:$s6: BlockCopy 0xc6b4d:$s6: BlockCopy 0xfd36d:$s6: BlockCopy 0x13398d:$s6: BlockCopy 0xc4dc5:$s7: ReadByte 0xfb5e5:$s7: ReadByte 0x131c05:$s7: ReadByte 0x353ad:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.payment swift.exe.42fe420.8.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xc5d37:$a13: get_DnsResolver 0xfc557:$a13: get_DnsResolver 0x132b77:$a13: get_DnsResolver 0xc4444:$a20: get_LastAccessed 0xfac64:$a20: get_LastAccessed 0x131284:$a20: get_LastAccessed 0xc6765:$a27: set_InternalServerPort 0xfcf85:$a27: set_InternalServerPort 0x1335a5:$a27: set_InternalServerPort 0xc6a9a:$a30: set_GuidMasterKey 0xfd2ba:$a30: set_GuidMasterKey 0x1338da:$a30: set_GuidMasterKey 0xc4556:$a33: get_Clipboard 0xfad76:$a33: get_Clipboard 0x131396:$a33: get_Clipboard 0xc4564:$a34: get_Keyboard 0xfad84:$a34: get_Keyboard 0x1313a4:$a34: get_Keyboard 0xc5931:$a35: get_ShiftKeyDown 0xfc151:$a35: get_ShiftKeyDown 0x132771:$a35: get_ShiftKeyDown
0.2.payment swift.exe.4392240.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.4392240.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.4392240.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x34a56:$s10: logins 0x6b276:$s10: logins 0xa1896:$s10: logins 0x344d0:$s11: credential 0x6acf0:$s11: credential 0xa1310:$s11: credential 0x30736:$g1: get_Clipboard 0x66f56:$g1: get_Clipboard 0x9d576:$g1: get_Clipboard 0x30744:$g2: get_Keyboard 0x66f64:$g2: get_Keyboard 0x9d584:$g2: get_Keyboard 0x30751:$g3: get_Password 0x66f71:$g3: get_Password 0x9d591:$g3: get_Password 0x31b01:$g4: get_CtrlKeyDown 0x68321:$g4: get_CtrlKeyDown 0x9e941:$g4: get_CtrlKeyDown 0x31b11:$g5: get_ShiftKeyDown 0x68331:$g5: get_ShiftKeyDown 0x9e951:$g5: get_ShiftKeyDown
0.2.payment swift.exe.4392240.6.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31f17:$a13: get_DnsResolver 0x68737:$a13: get_DnsResolver 0x9ed57:$a13: get_DnsResolver 0x30624:$a20: get_LastAccessed 0x66e44:$a20: get_LastAccessed 0x9d464:$a20: get_LastAccessed 0x32945:$a27: set_InternalServerPort 0x69165:$a27: set_InternalServerPort 0x9f785:$a27: set_InternalServerPort 0x32c7a:$a30: set_GuidMasterKey 0x6949a:$a30: set_GuidMasterKey 0x9faba:$a30: set_GuidMasterKey 0x30736:$a33: get_Clipboard 0x66f56:$a33: get_Clipboard 0x9d576:$a33: get_Clipboard 0x30744:$a34: get_Keyboard 0x66f64:$a34: get_Keyboard 0x9d584:$a34: get_Keyboard 0x31b11:$a35: get_ShiftKeyDown 0x68331:$a35: get_ShiftKeyDown 0x9e951:$a35: get_ShiftKeyDown
2.2.WdFVsOe.exe.25c2e6c.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
2.2.WdFVsOe.exe.25c2e6c.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2a7ba:$v1: SbieDll.dll 0x2a7d4:$v2: USER 0x2a7e0:$v3: SANDBOX 0x2a7f2:$v4: VIRUS 0x2a842:$v4: VIRUS 0x2a800:$v5: MALWARE 0x2a812:$v6: SCHMIDTI 0x2a826:$v7: CURRENTUSER
0.2.payment swift.exe.3042e20.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.payment swift.exe.3042e20.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2a7ba:$v1: SbieDll.dll 0x2a7d4:$v2: USER 0x2a7e0:$v3: SANDBOX 0x2a7f2:$v4: VIRUS 0x2a842:$v4: VIRUS 0x2a800:$v5: MALWARE 0x2a812:$v6: SCHMIDTI 0x2a826:$v7: CURRENTUSER
0.2.payment swift.exe.427e9d0.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.427e9d0.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment swift.exe.427e9d0.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1482c6:$s10: logins 0x17eae6:$s10: logins 0x1b5106:$s10: logins 0x147d40:$s11: credential 0x17e560:$s11: credential 0x1b4b80:$s11: credential 0x143fa6:$g1: get_Clipboard 0x17a7c6:$g1: get_Clipboard 0x1b0de6:$g1: get_Clipboard 0x143fb4:$g2: get_Keyboard 0x17a7d4:$g2: get_Keyboard 0x1b0df4:$g2: get_Keyboard 0x143fc1:$g3: get_Password 0x17a7e1:$g3: get_Password 0x1b0e01:$g3: get_Password 0x145371:$g4: get_CtrlKeyDown 0x17bb91:$g4: get_CtrlKeyDown 0x1b21b1:$g4: get_CtrlKeyDown 0x145381:$g5: get_ShiftKeyDown 0x17bba1:$g5: get_ShiftKeyDown 0x1b21c1:$g5: get_ShiftKeyDown
0.2.payment swift.exe.427e9d0.7.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xb4deb:$s1: file:/// 0xb4cfb:$s2: {11111-22222-10009-11112} 0xb4d7b:$s3: {11111-22222-50001-00000} 0xb3f2d:$s4: get_Module 0xb42a8:$s5: Reverse 0x144557:$s5: Reverse 0x17ad77:$s5: Reverse 0x1b1397:$s5: Reverse 0xaf6c1:$s6: BlockCopy 0x14659d:$s6: BlockCopy 0x17cdbd:$s6: BlockCopy 0x1b33dd:$s6: BlockCopy 0x144815:$s7: ReadByte 0x17b035:$s7: ReadByte 0x1b1655:$s7: ReadByte 0xb4dfd:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.payment swift.exe.427e9d0.7.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x145787:$a13: get_DnsResolver 0x17bfa7:$a13: get_DnsResolver 0x1b25c7:$a13: get_DnsResolver 0x143e94:$a20: get_LastAccessed 0x17a6b4:$a20: get_LastAccessed 0x1b0cd4:$a20: get_LastAccessed 0x1461b5:$a27: set_InternalServerPort 0x17c9d5:$a27: set_InternalServerPort 0x1b2ff5:$a27: set_InternalServerPort 0x1464ea:$a30: set_GuidMasterKey 0x17cd0a:$a30: set_GuidMasterKey 0x1b332a:$a30: set_GuidMasterKey 0x143fa6:$a33: get_Clipboard 0x17a7c6:$a33: get_Clipboard 0x1b0de6:$a33: get_Clipboard 0x143fb4:$a34: get_Keyboard 0x17a7d4:$a34: get_Keyboard 0x1b0df4:$a34: get_Keyboard 0x145381:$a35: get_ShiftKeyDown 0x17bba1:$a35: get_ShiftKeyDown 0x1b21c1:$a35: get_ShiftKeyDown
Click to see the 25 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: payment swift.exe

ReversingLabs: Detection: 30%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe

ReversingLabs: Detection: 30%

Machine Learning detection for sample

Source: payment swift.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe

Joe Sandbox ML: detected

Source: 1.0.payment swift.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 0.2.payment swift.exe.4392240.6.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "host39.registrar-servers.com", "Username": "dickson@potashin.us", "Password": "*r4} Du LH n87G"}

Source: payment swift.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: payment swift.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
payment swift.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report payment swift.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Windows Analysis Report
payment swift.exe