Overview

overview

10

Static

static

3

Quote JQ10...df.exe

windows7-x64

10

Quote JQ10...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Quote JQ102474.pdf.exe

  • Size

    659KB

  • Sample

    240429-ma148age8y

  • MD5

    d486bb0e00d7058f5f03c1a51163fe95

  • SHA1

    5c592c9f14bcbaec81b07d9f149a9f1e0b9b1859

  • SHA256

    e0581b57a7e87e38a5a0ebf8861f816a415bdcb037111f32ba4bdbdc78ca9be3

  • SHA512

    d192ac15f9b13f8434316e5f6f3d2d487d75daad8b05d0f79faba619eec4209a27f5c6120ce58e4137dd1e9fb2ffe03e0825c96ab963476a1dff7f4a5b2f579e

  • SSDEEP

    12288:FrmB778QzrSmyxk3CFAEFaNWyN4rfs9xBYGp1TbFs1SoyDveri69rJiTrJyY20m:JmBlSmyCy7FcWtrEZY01nUyDvGiJyj0m

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Quote JQ102474.pdf.exe

    • Size

      659KB

    • MD5

      d486bb0e00d7058f5f03c1a51163fe95

    • SHA1

      5c592c9f14bcbaec81b07d9f149a9f1e0b9b1859

    • SHA256

      e0581b57a7e87e38a5a0ebf8861f816a415bdcb037111f32ba4bdbdc78ca9be3

    • SHA512

      d192ac15f9b13f8434316e5f6f3d2d487d75daad8b05d0f79faba619eec4209a27f5c6120ce58e4137dd1e9fb2ffe03e0825c96ab963476a1dff7f4a5b2f579e

    • SSDEEP

      12288:FrmB778QzrSmyxk3CFAEFaNWyN4rfs9xBYGp1TbFs1SoyDveri69rJiTrJyY20m:JmBlSmyCy7FcWtrEZY01nUyDvGiJyj0m

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks