Overview

overview

10

Static

static

3

QUOTE.exe

windows7-x64

10

QUOTE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTE.lzh

  • Size

    1.2MB

  • Sample

    240529-l7274sbb2z

  • MD5

    cd93f64fd352162c4cfbaa2103d1115d

  • SHA1

    37dda86db2b48aeb1f159e8e15d05034c0554bf2

  • SHA256

    70a8aaae3f6a139b0fbaeb3d14b796e74293593741dd8dcfef0f4ba5cc3371a6

  • SHA512

    fc905da54e46bfc645c379831695bd3b1a530c408032f558284cf11a307cf44a1ae5b660e702eb2eb63d224c42de4df12f6026f1183d7095ddb9a10197f40929

  • SSDEEP

    24576:6KEedGN1b82LcJX/JKDf8UBzXWJI3EJIwkl47CDm5:6KEedKmnMbnzCI0JwnDc

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    terminal4.veeblehosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ifeanyi1987@

Targets

    • Target

      QUOTE.exe

    • Size

      3.1MB

    • MD5

      240af48b0056bf939726436ef834a2e8

    • SHA1

      c6296a588d14af7fcc8dedeee566790eeee2193f

    • SHA256

      724fd513b28f07121fc19f1adb2173365d55a988e6ac03992a04ca7a654a6c9c

    • SHA512

      4594427b57c16d5a8fe64cc07a706cdabfc3840a35a80c72813bcacbf4f8a16c40f56b2fc0da653432bfab8cee640b21dac079f94d669b60ca356d7d75aa887b

    • SSDEEP

      49152:u8yJAk206NICMq5pzKRgqVzKoYgFtRq3mfPi:ZBsa8P

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks