Overview

overview

10

Static

static

3

QUOTATION UPDATED.exe

windows7-x64

10

QUOTATION UPDATED.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION UPDATED.zip

  • Size

    665KB

  • Sample

    231208-x997aadgf4

  • MD5

    b3e462eeadf8487945f1128fba5ab19b

  • SHA1

    e9d710541aff448523a8bf3f1f3ecc8c0ffb5067

  • SHA256

    d02ac6c603acd90105e13abd589b44720e4f2c3b2dd9cb9f2be9f3fa4b4ac310

  • SHA512

    dc37f2d5797dd7047e6fc03cda9fb8f2865519a3118730dd034ffb40b777f0abe5041fbd7ec18ae3f7ce089f62febce78af3a3468cae9a549d8d3d304932f860

  • SSDEEP

    12288:y37+tI6jGR2iQsfb0nkEwgScpiejAFiOR/3YnZavoF/o4nsswZ0JbHV+m9G/80bU:y3mSXQsj0npwB6iejy3YnZavoF/EiJYC

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      QUOTATION UPDATED.exe

    • Size

      776KB

    • MD5

      a764e65cdd09df4df3168ebbe6a5bcd7

    • SHA1

      47cb387c38f5c3bf3ea6eccf0afffaa02aa2788c

    • SHA256

      de1f13055e11a5175a5401b2f765228a9e61e196cbc60c1417906bfe9f4ce688

    • SHA512

      4aaa8ea703e70729944a4831d7b3278284e04d4558b7c2015beb44f97a46508a6fb6ea07e01396e6ab1604ef57d603aae3ac351e851df0e7e7998cf593c25d33

    • SSDEEP

      12288:MG1XhkZ5EG92iQsbb0nkuwuSctiIf2Fi8Rp3yLMkM7ojSDWPz/8CS/ETuGq:MgK/JjQs30nVwjAiIf+3yLNM75gIFy

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks