General
-
Target
QUOTE4501.7z
-
Size
703KB
-
Sample
231206-rhe9yafb58
-
MD5
7c633297088a6e931345585d7a2afd5d
-
SHA1
e1c56871a491573869ad4ea8e6fb8bf02bd4e3ca
-
SHA256
da97eb7df3991c3cea50faa30ffc2740d10444aba42455f29d7ccd44c24db3d4
-
SHA512
f61db2303d706c0594eadd3b5fd9177d425cdc2d21c0b730355ec6d64c7ea698a3b2cd6f0c9ca32a5aea1379773b90c8c8a3eb41a02267dae16d8c7745f86841
-
SSDEEP
12288:SxNm73hc0MCn4P2tkwJR4lpi/fUauNTlFZMwmC7G0pV7AVbpLGnr3LljD5jiQB2M:wgLhc0Fn4ikk0IgZMwmwn8GntDFiA9
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE4501.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
QUOTE4501.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.oripam.xyz - Port:
587 - Username:
[email protected] - Password:
231Father@
Extracted
agenttesla
Protocol: smtp- Host:
mail.oripam.xyz - Port:
587 - Username:
[email protected] - Password:
231Father@ - Email To:
[email protected]
Targets
-
-
Target
QUOTE4501.exe
-
Size
893KB
-
MD5
efb3dbc98a7974b96d5b7d520daf7bdc
-
SHA1
b700166cbe9f33206f7c35e96c0a1f0482a01368
-
SHA256
2c76e1c69745332a74f8bf2a9750b20d6b331af1d54550f94a03dfb475ac655e
-
SHA512
8ff20b8cf0dc11eca1835ae2c0993449afe9a258523d7a5d686156bea033037a7fc6d15daf0e96a0fb4a058e06adcf7be369bb46a106d01c46d5ee93d96aa0a3
-
SSDEEP
12288:cBaPwVueH5qX7xEXFXLkwJn4Qqvseieb3teGZM9m37GRpNlAYb28GukXWlfDljip:cwPGqXN0Fkk2LvZM9mID1GuVDRi
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-