agenttesla | 2c7053b3f38ce4121cfd3a203360455c[.]bin | Triage

Sharing

General

Target

2c7053b3f38ce4121cfd3a203360455c.bin
Size

82KB
MD5

fae8c203b4b97d93116ba9d7444749cc
SHA1

ae07d1de9cd93cca175997311c03b55b91e83ca8
SHA256

7e95a9c49f3437a34013d085e0d14c43a726a682c6abe32df500cc9feabac918
SHA512

7a3cded29399070acfa9440d6cf785e9229f91c5405f14191183900803b215f867d263bf77a5837f4b57ea005063a751993ca33964b62889eb4f04a10b775e25
SSDEEP

1536:IrHaDxqLxB1/XtCut+gdjgCA7Af97TfC9OmIgDwBzoWXAQea8OWdOkfHx9v0n:YHaxK5/XtCu4ajgZ7Af1TfBmIgbFa6d+

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.worlorderbillions.top
Port:
587
Username:
[email protected]
Password:
7ace90qwerty
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5fcef5ddef0a34f70e1e879e60868a8bec88ccd0071a9895961172f3a9c6601f.exe

Files

2c7053b3f38ce4121cfd3a203360455c.bin
.zip

Password: infected
5fcef5ddef0a34f70e1e879e60868a8bec88ccd0071a9895961172f3a9c6601f.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ