Overview

overview

10

Static

static

QUOTATIO.exe

windows7_x64

10

QUOTATIO.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e89462a3608149699b7bc38e573fce07a7e62759d3d42f578e3cebbf754bb9c

  • Size

    1.2MB

  • Sample

    220520-29knvagdh7

  • MD5

    e7d3bc0cc38963e4069bd8273304ae11

  • SHA1

    69405f5349cc07e1eb05c67f4d85d17aa5acd357

  • SHA256

    6e89462a3608149699b7bc38e573fce07a7e62759d3d42f578e3cebbf754bb9c

  • SHA512

    e2d9cbbeedd027a42b17a49bb7e8f06822f0c89231ea193072f0a44f51258a79c24e1157993878d85292de6bcdc2c6a2b891eb8e94c039f181340cc9daeb8bc3

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    chika12345@

Targets

    • Target

      QUOTATIO.EXE

    • Size

      407KB

    • MD5

      086d3778e1a2fbd66b2306a1410ba159

    • SHA1

      79e0b0ad3ec89b316ca19e49e385dffd804dcdce

    • SHA256

      95a2794993515cebc252e9c2862009a653f5c8930b78127fa7ba34b59493291c

    • SHA512

      31b980f9b47321531189734a644cddc3d129040b00a2c52c1855287decc55d0f77b955a7dd5db20b2fb6deef5ddaab97f4762df19f1b2573ac4fd56caa292955

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks