agenttesla | 81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c.exe
Size 18.3MB
Sample240608-bp8basfa4s
SHA256 81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c
MD5 2c26d6595b88f541ff15e7c18fd51615
SHA1 81648ed910677c3a8f13921c169eca46ffa9fd0d
SHA512 33e61bb57cb56ac812f843e49149950db9483df723cbb0c33fc5a91e6c665997f0de0c36857b8264a88566270715c403a2cfbe428a232f0928a68cd5e8ac4bc0
SSDEEP 6144:gm4+2umudLLt/iP5uMBujBEigsFby1/R:K+2umudLLt/iP5vPcFb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c.exe

File Explorer

81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c.exe

.exe 18.3MB

81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c.exe

SHA256 81413ed396ac78afe7643bc9cf072e20e0c055b06d09c77ae65d95ffa7e4b47c
MD5 2c26d6595b88f541ff15e7c18fd51615
SHA1 81648ed910677c3a8f13921c169eca46ffa9fd0d
SHA512 33e61bb57cb56ac812f843e49149950db9483df723cbb0c33fc5a91e6c665997f0de0c36857b8264a88566270715c403a2cfbe428a232f0928a68cd5e8ac4bc0
SSDEEP 6144:gm4+2umudLLt/iP5uMBujBEigsFby1/R:K+2umudLLt/iP5vPcFb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect packed .NET executables. Mostly AgentTeslaV4.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Detects executables referencing Windows vault credential objects. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Detects executables referencing many email and collaboration clients. Observed in information stealers
Detects executables referencing many file transfer clients. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

247118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths