Overview

overview

10

Static

static

3

NEW QUOTATION.exe

windows7-x64

10

NEW QUOTATION.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0552e32bc94aa9e30b9673e9eea2a1e234c136a03c1a790e2949b1aed8e571e

  • Size

    625KB

  • Sample

    231207-bd3xfaaab2

  • MD5

    a6b74e3607299a191fc3b1b647b8577f

  • SHA1

    0bbcc60c50065f2bae800162b6789567da7f7273

  • SHA256

    d0552e32bc94aa9e30b9673e9eea2a1e234c136a03c1a790e2949b1aed8e571e

  • SHA512

    40fb651bd996174166562309f4122672e918f2564a19b73aa505d698d7016139989a2b96e804133ccdd1964ca5eda0e1d969fee0629408f9d626361df0fda832

  • SSDEEP

    12288:hWDnFsmaseWBvQZwbjyp0HHO5JTxgHs5W1DZpiChTLWTBc1JCNoFMF:hWDnFsmp9BvS6jyp0H2VxgHEW1DZpBLw

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      NEW QUOTATION.exe

    • Size

      683KB

    • MD5

      6adb7b71640a2f11f8144693e2b15d41

    • SHA1

      38c3551a6b02c88e793f37b29a522071100bced6

    • SHA256

      b5cd63c5fec95f16d9c11ca726e0bad76d52eb122a6458b3940d5dd94d3a7dfb

    • SHA512

      d5a6bca0366b1aed4c03f70defc319e70932c18d9ca89183f08479aa8d306532a50f3e06a08fe4182ae0e86e2980b5971940dca75a5a397f48da5e26d4664c30

    • SSDEEP

      12288:C4ueH5qfhisCn/zzGAfjmT0HHy5Jvjgbsfc1DhpYChjAVejJI:PqZxwG4jmT0H6Vjgbcc1Dhpbac

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks