Overview

overview

10

Static

static

10

HEUR-Troja...la.exe

windows7-x64

10

HEUR-Troja...la.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan-PSW.MSIL.Agensla.a-5632593f65bbba5fc3f243430f7a234aec5b86b375578cb7c33645ade6965e9e

  • Size

    235KB

  • MD5

    46d94a3e0b29371c85999c23e112e20d

  • SHA1

    bde9bec6e7de5997a952748c01f1f0f4f792e694

  • SHA256

    5632593f65bbba5fc3f243430f7a234aec5b86b375578cb7c33645ade6965e9e

  • SHA512

    53b02ee66ae7949dd5c25f6bfffd8695365feb4cab65888290bb8added9ca0ea39f794222bae7ee4e987bc9096f56fb9d96cfeedc00ca55f4e3739f23d093ecb

  • SSDEEP

    3072:yGvLLTjbSiUg185NqqKIe7BNZ519X3Xb:LLLTjbSiUg182q6BNTXn

Score
10/10
agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • Agenttesla family
    agenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • HEUR-Trojan-PSW.MSIL.Agensla.a-5632593f65bbba5fc3f243430f7a234aec5b86b375578cb7c33645ade6965e9e
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections