agenttesla | 10212ba46bfc4a8b427083c7d3099161[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10212ba46bfc4a8b427083c7d3099161.bin
Size

85KB
MD5

b5b310f5b4cc0a9015a13f4a5dba9395
SHA1

79ce5c2e60d19d931caad4591367fcfbe594c1db
SHA256

7521f92fdddeda84a49085f9387d6c2da4bb545fd41c618f557ea38ea62a9e4a
SHA512

5eafc63a1805c1c1868956bc520de7c860ee5bd1848ab280b371b52eb210261bf484a3d9bf3b958b2747e88440122e2b8be47860eac44f979761a57f92b63b46
SSDEEP

1536:25dPNA6glJafwe/dhRNYiu1WibqXzI1nbQk0ddGXlKg9f2KDt4p:+KtJa//dhRZu1mAQrubltw

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/44ed0060eab08595d2b4ad0626e5271728b42de5e5e88cc92428adc92dd79605.exe

Files

10212ba46bfc4a8b427083c7d3099161.bin
.zip

Password: infected
44ed0060eab08595d2b4ad0626e5271728b42de5e5e88cc92428adc92dd79605.exe
.exe windows:4 windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ