Overview

overview

10

Static

static

5

QUOTATION#...LS.exe

windows7-x64

10

QUOTATION#...LS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION5400-QUANTUMMACTOOLS.TAR

  • Size

    878KB

  • Sample

    241014-q4e1masekn

  • MD5

    e74bb8daec6f0f96a5e3cb1ebe48f947

  • SHA1

    5e8d37ab4dfb4d31821b47d65260c2a11685efb9

  • SHA256

    435e957062edf2df5b2987bbbc5f9468dc167a3caff55f3389c8836243a4c29c

  • SHA512

    76a7343a89e7f7ffb120949c8d8406a7a6e9571a0555ec3e3c2aecee18c6684f0e8701ba0e3a8057218e93c4749a1a7d2d4fe5078404322d1ba5f75c8f2ea9ce

  • SSDEEP

    24576:JPjfYKO13GnKAuxZBveWLzi/eFC/y9WxcRz7Y9uKg9x2yXLmG:J7fYKQW90B2Yzi/eFhoxcRCurx24p

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ercolina-usa.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    uy,o#mZj8$lY

Targets

    • Target

      QUOTATION#2800-QUANTUM MACTOOLS.exe

    • Size

      1.2MB

    • MD5

      0e4fd4b092e0d72115cee4f57c213e40

    • SHA1

      9a51a95fcd769a34858ca632a457cd88a3cf2c78

    • SHA256

      193cd85dbdd5cab748839284a4c2396f4db7fa366ad5c55718de2b742cda59dd

    • SHA512

      1b115795498f43e358dae28f764f7be294192eb1899d05aba8cfbf0e92e3504e7973c0d8cc7873fb4a7641230c4cb27da686d62655b98d61c04fe4a7cd1738ff

    • SSDEEP

      24576:WfmMv6Ckr7Mny5Q6AavJmwv3e/UnHg/PzJTKOk74jrgVRb:W3v+7/5Q6Aaxm+jEJTO74jrgLb

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks