AgentTesla[.]zip | Triage

Sharing

General

Target

AgentTesla.zip
Size

712KB
MD5

6eddedcd16bf58fc5801558732e6c9b7
SHA1

0365c360ea4bcd23c40326dc46a8880649c03ef1
SHA256

5fc2ab9adb6701bbdcae6ecbd07045f76a74b6551f10133c9194944accc3947c
SHA512

0b0bd3fbd87296ac2a75b17c37c0d1e02922643c8fd87573d0ca475cc67f092e51d1f7b8c5c6c8257a56bb041fa6e99e750adf97b5a64d65d8ad5ed1485f64c2
SSDEEP

12288:llaeTmntL/K6LOlMBnRd9qFQGQO/8l+oFfqv5bH6nBrLnqlDJCZ4WTKy6up8cs6:9ynhK8RROh/voFfqxbHEqVY4WTKy6uuu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ff70339ef950407a12f181c63d5b3d59fe40198237d97ce3c6537403c7863624.exe

Files

AgentTesla.zip
.zip

Password: infected
ff70339ef950407a12f181c63d5b3d59fe40198237d97ce3c6537403c7863624.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 698KB - Virtual size: 698KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ