Overview

overview

10

Static

static

10

aa45cc2358...fd.exe

windows7-x64

10

aa45cc2358...fd.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aa45cc23581cddb7fcc637b634c203f475d266032fa95725a3f7e84330c1ebfd.exe

  • Size

    238KB

  • MD5

    bfc2eb591ad87cffce1dd3f5085e43e3

  • SHA1

    1014e96c0cbbe5b596b060096f7796f1d5e1d4c9

  • SHA256

    aa45cc23581cddb7fcc637b634c203f475d266032fa95725a3f7e84330c1ebfd

  • SHA512

    706b79e64373f62c4750812793a5043d22f413b3c6a5f980bc12b98483f5f9c37c8997a9f01c1a43b1d5753d06d7d5ef5f80bc7562da461b48f4fb8fe3a33697

  • SSDEEP

    3072:UqKpQb1htB1Tpeaqm86z4k8geoG0MsvPb30+n5Lht+r7E:+Qb1htB1lef6YNbsnb3jLtM

Score
10/10
agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.folder.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    R2r76%(3v^H0

Signatures

  • Agenttesla family
    agenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • aa45cc23581cddb7fcc637b634c203f475d266032fa95725a3f7e84330c1ebfd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections