General
-
Target
dc9592af2ffbbfcf84b85b78b82608017b1fa5c5f406ba9ecb6c03d4a50b9697.exe
-
Size
234KB
-
MD5
5356bf5341a1e2507f0c5442b9fb8880
-
SHA1
c5195a71c60290a4383e2269b796694d383e56fe
-
SHA256
dc9592af2ffbbfcf84b85b78b82608017b1fa5c5f406ba9ecb6c03d4a50b9697
-
SHA512
b54cf15ed88e2166ec31a546db3c8a27f7560c8b64305706767bd800bb53b70a3c0f03e5d7dd4bb1415e41a974d46ff9697408febd0391d50f93fcc1ab88b682
-
SSDEEP
3072:lgQRfeCmyQG4Ovza7bErD7Hp8TXUItgsT5US2I8R0:lgQRfeCmy14Ovza7bEn7kRgsCI8
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.ahlada.com - Port:
587 - Username:
[email protected] - Password:
21rY$9U}48j] - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
-
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
-
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
dc9592af2ffbbfcf84b85b78b82608017b1fa5c5f406ba9ecb6c03d4a50b9697.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections