agenttesla | at_maybe_d3c0f8d7e5eff92fb6378a1ccc62c8aba3944d12ccaade18fda748c9a7f0ecf7[.]zip

General

Target

at_maybe_d3c0f8d7e5eff92fb6378a1ccc62c8aba3944d12ccaade18fda748c9a7f0ecf7.zip
Size

97KB
MD5

714e9097f6d6e6cf322fd74db1fe31a4
SHA1

13cbaf8ff78b791d72c82d8dff9cca4415abb526
SHA256

b98e93cfc5c28890106f7e2264de84e7552694142e10104fc5d1b894044277d5
SHA512

97961644916150396cbdb6525b7dffa1466a05ed16043e324fe6ab2d5d198dc86e14d42d4f24ef2fd0cc855557eb836b225c1707f63ec89a054416a37c4aa5b3
SSDEEP

3072:NJeNCAYYT/bnqY5fKnT3N8eDn07UwLv7BKqyEIH4uNi:NJekST/rMN8mn+UUUT3Yu4

Score

10^/10

agenttesla

Family

agenttesla

C2

https://discord.com/api/webhooks/1153223870891958314/4fjTdg6uWPR-Mfasd2z9A9lMK59UySWkNCvaFZXMHtU0FDbkkjIMF2XSDIeUY1fHd9R4

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d3c0f8d7e5eff92fb6378a1ccc62c8aba3944d12ccaade18fda748c9a7f0ecf7

at_maybe_d3c0f8d7e5eff92fb6378a1ccc62c8aba3944d12ccaade18fda748c9a7f0ecf7.zip
.zip

Password: infected
d3c0f8d7e5eff92fb6378a1ccc62c8aba3944d12ccaade18fda748c9a7f0ecf7
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ