Overview

overview

10

Static

static

3

Quotation.exe

windows7-x64

10

Quotation.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4730eb6a1ec77f12f905927429f5c6ec048c88ec70f4654cf3ae8d0eb6cac329

  • Size

    670KB

  • Sample

    231205-vtyr7sda3z

  • MD5

    ba0f9e01e95d5d03198509851765dfb7

  • SHA1

    35fee71bd2b220865ed9f24126ae8f32daab8b7d

  • SHA256

    4730eb6a1ec77f12f905927429f5c6ec048c88ec70f4654cf3ae8d0eb6cac329

  • SHA512

    a4070675cb4584907662a88ca44eabb3e4985e3760c1f4bf4602e03e0dac3f7f1de9b58eb6631e7d4b41b9fa43904265cf250c21f398667cd7136742f8b4ad5a

  • SSDEEP

    12288:zkoH84xPQGOhdtEgsPmAWl7EXe6tONOR/AdpDuF8eHsX73s8vdk9:zkoH8xGCtETPmFn0OY0w/HsXLF+9

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Quotation.exe

    • Size

      830KB

    • MD5

      985225f6ec19a166c50bd5d0e16d330f

    • SHA1

      9022950aa9cef1cc010c636a97b229e30d0002b0

    • SHA256

      82cb6a221ee2b2c0c0f43139765407c713ff6980d966544f71f351c66928a4da

    • SHA512

      a4d5576cc36994ae0d6bfa0545961370f429bd8a4e875a65e77f6f4cf522dbf1fa82fb5491b593f26178a6a27c8c1b54214b06c29b43a6c2e09908ab4361d5a0

    • SSDEEP

      24576:koPOk+pJZDI7EeT/ZhOX0IAmQeY14VDjh:nyJ6ZT/Zh3IAmQ5qD

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks