Overview

overview

10

Static

static

quotation.exe

windows7_x64

10

quotation.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    quotation.exe

  • Size

    490KB

  • Sample

    210408-msfttq63hn

  • MD5

    ec1a733e7836a93b1aef885dca064acc

  • SHA1

    92b3cce4c760b3a0a865bb4df0e0f376da6c9c6b

  • SHA256

    b158522e8d0e95fe5aa6fe99014399ce3e9edd85a93ac61b30d9d1dd31ef382e

  • SHA512

    cdb1e4ca8fb67684e8e34a20d2ee4ef6ca461506bb613ec53994bfcf18d70e402db265116f9579221a29cbff7d1851662448dc65b5d9c399d1f487b5563e225b

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.kugel-medical.com
  • Port:
    587
  • Username:
    sales3@kugel-medical.com
  • Password:
    stanstan12345

Targets

    • Target

      quotation.exe

    • Size

      490KB

    • MD5

      ec1a733e7836a93b1aef885dca064acc

    • SHA1

      92b3cce4c760b3a0a865bb4df0e0f376da6c9c6b

    • SHA256

      b158522e8d0e95fe5aa6fe99014399ce3e9edd85a93ac61b30d9d1dd31ef382e

    • SHA512

      cdb1e4ca8fb67684e8e34a20d2ee4ef6ca461506bb613ec53994bfcf18d70e402db265116f9579221a29cbff7d1851662448dc65b5d9c399d1f487b5563e225b

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks