Overview

overview

10

Static

static

5

Quotation.exe

windows7-x64

10

Quotation.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ada2a88f7e37c34bf36562944a77c31615d52871b4a7a5affadc2ccb33e91a4

  • Size

    683KB

  • Sample

    241119-b1kpdazaql

  • MD5

    ec6a174ab2e2291125b056e7fe16fb2d

  • SHA1

    5a5019cd8c1e963ef8b7707f6e7e9ed2d4ae7cf8

  • SHA256

    8ada2a88f7e37c34bf36562944a77c31615d52871b4a7a5affadc2ccb33e91a4

  • SHA512

    3cb2d843ba556d63cb6c9ed913836d9effbb11332e71c67be42bbb0b85292b77280952f43f6ce73bf9515d468b67b1df5ba439fb27a7327204e66abd0b69a3fd

  • SSDEEP

    12288:qqDE2Ip2xmTMdi8I5cj1Cr1hIzUTdABZwd/CrW0Spi+aO:k0mh1V6U0SpraO

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Quotation.exe

    • Size

      1.1MB

    • MD5

      b212fa3352a4a6241a7f9e4a4c5f34c7

    • SHA1

      a6f48804432852af371ecf57a8d20c9d431cecab

    • SHA256

      c3920d8006e3e708991f93c1ee2c4f1f38d116ce3bbcce5a0072d11d8f8a19a3

    • SHA512

      d1c2be0deacf9460dc281ee3f1d4bf1e45c0d1f99409a570242446ec2eb9d417ff93f302e09e70c7003b62bb898cbae7683cb3821fd46468d425ff555bfcda97

    • SSDEEP

      24576:stb20pkaCqT5TBWgNQ7aJVI176j07prnV6A:VVg5tQ7aJVIW0T5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks