agenttesla | 825c5481124b879a01a30dcef3f20091[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

825c5481124b879a01a30dcef3f20091.bin
Size

83KB
MD5

a739e03328004e8f78d150c0e079c3b5
SHA1

579c1aabb5065d603a6f67cb31f40ec67532cc7f
SHA256

ad20783199ebbcbc465a152aa594f2683536c9cc9cd7d0ff7770cc7709343438
SHA512

f9c1a0553e76449a2178dfee6f5fe1c94f86f78a362bcb45995a69f78b8018bb4135f81926d6a974e58d370da26afc8add2dad84d9a45811e6252ea347d5938e
SSDEEP

1536:6r8fJ1QQgZ8xWsfyrfcOvH0ySe0d2y3ik0HQY8qGiZvwMQ38wNcUNufOS8V:6hRGLqrfjULeRy3X0HD8qGiZvLQswNc0

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.incesa-br.com
Port:
587
Username:
[email protected]
Password:
Yrj(oGL3
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6e3b2848076301757bd25bbc984e88e75136fb38e8374d4c8c00198d93173af5.exe

Files

825c5481124b879a01a30dcef3f20091.bin
.zip

Password: infected
6e3b2848076301757bd25bbc984e88e75136fb38e8374d4c8c00198d93173af5.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ