agenttesla | 7e5dfe0a86936a5229272db7e26b597b65c36eb7e930b70f7727ce082ceb9485 | Triage

Sharing

General

Target

7e5dfe0a86936a5229272db7e26b597b65c36eb7e930b70f7727ce082ceb9485
Size

240KB
MD5

4d040e7e33857fe4aae9fda8069d3db4
SHA1

b12feff8d44a8ac6dd37c07260e77599339e4f52
SHA256

7e5dfe0a86936a5229272db7e26b597b65c36eb7e930b70f7727ce082ceb9485
SHA512

aa49985d64f0ab1c6916cb916f084d5f53cfe056e3487e4ac5306e3ca26932a049e92bf65705cd55d0f01825142cc2238fd9b17a9d53192fb2d4fcbc151863df
SSDEEP

3072:cwdndNlFNkWtFwAoj8cFJGLTj5gmDT1tR:RdndNlFNkWt6XNJGXfDh

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.officeemailbackup.com
Port:
587
Username:
[email protected]
Password:
fiKV73cEXrT#
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
7e5dfe0a86936a5229272db7e26b597b65c36eb7e930b70f7727ce082ceb9485

Files

7e5dfe0a86936a5229272db7e26b597b65c36eb7e930b70f7727ce082ceb9485
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ