Overview

overview

10

Static

static

3

QUOTATION#35674.exe

windows7-x64

10

QUOTATION#35674.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION#35674.zip

  • Size

    623KB

  • Sample

    231212-j8zr9sbbc9

  • MD5

    03e717ed06db8781c04da0da513356f0

  • SHA1

    3bec3d759dc1c25f1f92a323bb84d2db591a15ca

  • SHA256

    a5410c6d47e6e3101946bacd6f4ed5d8f3c3f817ac2856b45a8aba93c5aadd8d

  • SHA512

    b0971ada104c20b0fade518c1ac8267a055545c6d69a0fa4e212f4743e2c7d6ae515707911627723d2572d0ce8d1fc20170f565bb38e247311c4459864d39915

  • SSDEEP

    12288:j4toRVcLj9HxWSe4SHbpS4g7xXwyK/JIE5eRsNTWywc7Iq:j4torcv9HxePbpv0XwDRmfSIq

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      QUOTATION#35674.exe

    • Size

      885KB

    • MD5

      7e597b7a940ce9fe398f5a09ea06e9c2

    • SHA1

      46fab946b897f1b804aec6183d9c60bad103e9a4

    • SHA256

      4722e9113d3f8eaa1956f990da588f8eed324bb8d5551d52bff3bf4536a6010d

    • SHA512

      354d258b9605425b5037822fbc24f17c07b83095d0f2ef9ff86d4ca6f9b0ee8bcacce7741eee1c04e3b12fd22e99ad1ccda5ffe6050c19320ba68564e8cf3c82

    • SSDEEP

      12288:r91idWEW7UN5vDnSX1zCyG/JW+50zKlDWjDS6VtgMyie2:r+YiUzCVR0FDSMtZyie2

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks