agenttesla | 73f1b726febd788d14097398b3ae2074[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

73f1b726febd788d14097398b3ae2074.bin
Size

82KB
MD5

9b90436c85b93b370272522e09c17982
SHA1

279c6b52ff3c0d0813df0e8d963b2a252e747b33
SHA256

429c72635062e88543ce4b97f7fa6e7bbf2221bc4a7622628a5b33402a1fa478
SHA512

102493f1d576612ac8b9af42abb5b567ee5768c8f94a7cc2b736af52aea6c8160dfe52e43b53bf35e119cf4643f806246f1946a062df3807d0baa9c5e2f01a26
SSDEEP

1536:wrsE4Ul551M8qHItBGA4xrlzQP7XBJaFs/I5H3iKMaZik9Pa+Lk:CsEj57W4XGFsA11hZik9i+Lk

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.grasscarpet.ae
Port:
587
Username:
[email protected]
Password:
,fv6mMX}%+(h
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/251982ac02a87c546ef1872b1beae28856af968d01bc0783f1034cdd73bba752.exe

Files

73f1b726febd788d14097398b3ae2074.bin
.zip

Password: infected
251982ac02a87c546ef1872b1beae28856af968d01bc0783f1034cdd73bba752.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ