agenttesla | 6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f

Sharing

Copy URL Twitter E-mail

General

Target
6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f
Size 264KB
Sample240609-b6579scd89
SHA256 6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f
MD5 001d2d017b5a7716053d3f1486270f41
SHA1 134e90a630685756e64d4f9261a42b16a429bfb4
SHA512 dea76160993edc1e8b7e521a312fc8ad6b24fb13686650788ae17b573e7a6f0f56862c9368e9f18671d9efaa341cbbfcd03627f0fd8eb75c0985d6206ac9f0fe
SSDEEP 3072:V0Yi1Dv5+lRM0kkE0SrkY96A07YJqm05ieY639:VSDv5+lRM0kkE0Srk7r7AqmkYW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f

File Explorer

6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f

.exe 264KB

6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f

SHA256 6ded4860d0d448a3d6be053aeeb5dc5807237c626dde9e8753fb8e391a20085f
MD5 001d2d017b5a7716053d3f1486270f41
SHA1 134e90a630685756e64d4f9261a42b16a429bfb4
SHA512 dea76160993edc1e8b7e521a312fc8ad6b24fb13686650788ae17b573e7a6f0f56862c9368e9f18671d9efaa341cbbfcd03627f0fd8eb75c0985d6206ac9f0fe
SSDEEP 3072:V0Yi1Dv5+lRM0kkE0SrkY96A07YJqm05ieY639:VSDv5+lRM0kkE0Srk7r7AqmkYW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect packed .NET executables. Mostly AgentTeslaV4.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Detects executables referencing Windows vault credential objects. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Detects executables referencing many email and collaboration clients. Observed in information stealers
Detects executables referencing many file transfer clients. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1953856751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths