Overview

overview

10

Static

static

1

INQUIRY.exe

windows7-x64

10

INQUIRY.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INQUIRY.tgz

  • Size

    1.4MB

  • Sample

    230328-jy8bnahg43

  • MD5

    f6220a968f911de0dd25d939e8b927bf

  • SHA1

    916a65971f7285f531c7c6fd5a5dd6f2cbebd4e2

  • SHA256

    cad325d8c6fa8c2d73aa73177b96947dd1a572b663b8f7cbb7e2cb804a8ded04

  • SHA512

    5cc27460419e0716544132dd237dab469527720ef1287265af45ed01987a34582d7c139f872cdb6b2ee224894f423f78e8818492fd92cb3e28313adfee20b0e3

  • SSDEEP

    12288:3raTO1Uf5dkB/V8CN5ntTDdMaJWailiogsf2ub7HoLQrXNR4Ork4X5hmAlB:3raq1UByBW+t5xMEWUo2Q77Nv4UhmAP

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/

Targets

    • Target

      INQUIRY.exe

    • Size

      700.8MB

    • MD5

      4a9ba9c392508348b78258c5d95602b3

    • SHA1

      fe61759b5e30a0fe7b8e217d9fa97571b3018364

    • SHA256

      6ba64921b6bec546cd2843e931a133cc06a8ec4eb25b1675f4d0313c180d5a17

    • SHA512

      fa381ed00409ca71f023c9615859a658c145edcf996b9f023b9ba9d07d642509a34155cb66c8cf15a8140797d7b1924455ed9dfbe82330cdc160ef0d97382807

    • SSDEEP

      12288:Rtjamd0KdJVZz5dN+wGKvc/zoCj5nfj/tgaJaMWlKiQsfsuN7twLQnXNnCOpi4Bi:HpVZ9X+w+U2trFgEauosU7tNHoyFu

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks