Overview

overview

10

Static

static

Quotation.exe

windows7_x64

10

Quotation.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bd859aa47233dc5db5d0a077dc73a547f929a7689449c4a92a38eb2eeed9264

  • Size

    548KB

  • Sample

    220521-an1dmadeal

  • MD5

    9b1f83fab57dea8cf8ea680c50186e7d

  • SHA1

    97e32114a15f7afd1e3fff20d10f741e575e5573

  • SHA256

    6bd859aa47233dc5db5d0a077dc73a547f929a7689449c4a92a38eb2eeed9264

  • SHA512

    3e2ed8af9201f9de1f1eb8870605e55a1b94259d3a3186fdc1cc214f19d27b6ab0cc903960e60b0b024d66b717e752b78fbd3858864e2c455c0c5a507f71a06f

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @damienzy.xyz2240

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @damienzy.xyz2240

Targets

    • Target

      Quotation.exe

    • Size

      731KB

    • MD5

      d9ffdf10393af6088d6615b96c5b855c

    • SHA1

      afebeb060a7bb65926a0acb8a5093e8a5045b89b

    • SHA256

      ac15b0e93badb8bda06e37479e1de1e84e727106cdbe42b8cfe6bdb3bb9e035c

    • SHA512

      46e750b098ff52c1e580f363977e4e1f1cf5754d8f2aae1bddb23644c05192888e24a6b302920f68fb687e1249e55225b5003db2385c634bd495b3362b06e458

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks