Overview

overview

10

Static

static

5

Quote.exe

windows7_x64

10

Quote.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    329c909dcd75f8f668d4521d760b4a3832315e8bc13deb2b1d7dacd1dfc69a41

  • Size

    1.1MB

  • Sample

    220521-mngmqscag9

  • MD5

    393800ab3136d57b82d0712b0d3b193a

  • SHA1

    7b4a12deef739ae4a1ae5bddbde3b20f7cf26b01

  • SHA256

    329c909dcd75f8f668d4521d760b4a3832315e8bc13deb2b1d7dacd1dfc69a41

  • SHA512

    3992b7c4acb6fa3bdb13e369d0b82d001712bc5d1272f9b559d640b4f3abcf8b0c2a7a3abea07163e709fa77238da19a79c1be565702ab5c9ecafa14d8ca53c1

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.dubaisafariplus.com
  • Port:
    587
  • Username:
    booking@dubaisafariplus.com
  • Password:
    GtgZF07gXQbX

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.dubaisafariplus.com
  • Port:
    587
  • Username:
    booking@dubaisafariplus.com
  • Password:
    GtgZF07gXQbX

Targets

    • Target

      Quote.exe

    • Size

      1.5MB

    • MD5

      ad8a5b35629e4b23a1f1a52e491ec6be

    • SHA1

      fde1e20b6dfe29a364cb24a257d71f2f80f5179e

    • SHA256

      2f64c5edddb9b9bf16ff026a1ecd5a06fd5f3cc324434364944b4349130abb37

    • SHA512

      ce13a9741abb7c1e704c6be374068b5aa9675697f750fe165c9be0e6e95baab4adc821fbcdfc1f7ee5d1aaa522a2292bfb5cd4473d08b3fb3596019a96f72eee

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks