agenttesla | decode_d7e6aa1c282d0c7e264deac72702696a8295cd54fa9b12218af646cbffa03a1f[.]exe

General

Target
decode_d7e6aa1c282d0c7e264deac72702696a8295cd54fa9b12218af646cbffa03a1f.exe
Size 216KB
Sample230123-s5cm1aea38
SHA256 634d417309429ce5c6a447e15571db7435f58a750ca1d29d29b2abbbf03c4e54
MD5 7576ceaac2bb65f39a3cb71f429976da
SHA1 fa80ffd5aaf7992a58b403051d04bdab2800de70
SHA512 da4a1c7f38fcbf3dbc7f64439a856017695395e55fd28c959414438e15ba8a0757d6acd1c9dc2e40e19a93cd339381ef5f7a7925ff5975c8efc40d34a909d3f8
SSDEEP 3072:BfGWGrL0fWK9kmiY1WbxUsKUeyvfVessnUYMJRltSoKFb9dloNdVMI9UtUTQs:xt9kmbwUNy1eF2SpSvVMyIUT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument

Signatures

AgentTesla payload 1 IoCs

resource	yara_rule
sample	family_agenttesla

Agenttesla family
agenttesla

File Explorer

decode_d7e6aa1c282d0c7e264deac72702696a8295cd54fa9b12218af646cbffa03a1f.exe

.exe 216KB

decode_d7e6aa1c282d0c7e264deac72702696a8295cd54fa9b12218af646cbffa03a1f.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 634d417309429ce5c6a447e15571db7435f58a750ca1d29d29b2abbbf03c4e54
MD5 7576ceaac2bb65f39a3cb71f429976da
SHA1 fa80ffd5aaf7992a58b403051d04bdab2800de70
SHA512 da4a1c7f38fcbf3dbc7f64439a856017695395e55fd28c959414438e15ba8a0757d6acd1c9dc2e40e19a93cd339381ef5f7a7925ff5975c8efc40d34a909d3f8
SSDEEP 3072:BfGWGrL0fWK9kmiY1WbxUsKUeyvfVessnUYMJRltSoKFb9dloNdVMI9UtUTQs:xt9kmbwUNy1eF2SpSvVMyIUT
MD5 SHA1 SHA512 SSDEEP

windows x86

AgentTesla payload

Minor OS version

Major OS version

Entry point

227150

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing