agenttesla | c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f

General

Target
c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f
Size 236KB
Sample240614-cfrgvs1ekf
SHA256 c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f
MD5 617ad0bdaaf16b54569108d820b4563b
SHA1 00fda467f03cd853ed17881e841ac5996d429a10
SHA512 a0174fca4514c9d15040064919b5fb1adb9375a06f6648546597f088482b39d447f5b897edc9ee34d6fb219516b3e203ef41a4455136f0673aa60bf4d240dfa9
SSDEEP 1536:kkmpK1JrbTvTHTxkdfP6BGyOr/+v+ZCQl5Xeq2wpLh5km804m9dD6b8X9:s0TvTHTSl6BXOrGmHOq2Ih5Tem9dD6k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6440257655:AAEbQHCsYTBAVLyotbJIB5Sv7rPu0m4FQcc/

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/productsrequest.pdf.exe

File Explorer

c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f

.tar 236KB
productsrequest.pdf.exe

.exe 235KB

c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f

SHA256 c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f
MD5 617ad0bdaaf16b54569108d820b4563b
SHA1 00fda467f03cd853ed17881e841ac5996d429a10
SHA512 a0174fca4514c9d15040064919b5fb1adb9375a06f6648546597f088482b39d447f5b897edc9ee34d6fb219516b3e203ef41a4455136f0673aa60bf4d240dfa9
SSDEEP 1536:kkmpK1JrbTvTHTxkdfP6BGyOr/+v+ZCQl5Xeq2wpLh5km804m9dD6b8X9:s0TvTHTSl6BXOrGmHOq2Ih5Tem9dD6k
MD5 SHA1 SHA512 SSDEEP

productsrequest.pdf.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 434805a32020514878d2a332cd98861811dc9961f450f8225c7d8b818cafd8b6
MD5 40497e34399e8eb6c9270115d21299f8
SHA1 cbd263f699bf0968a67392e9f9943ff0ca693ba9
SHA512 52b7de851fe0b22668745989cc60c3d6eb2e7c603cd29815e1497b498d175841d61568f638bee71f502c7014819a0b286b81877f8d79a58d95eb68db77ae003e
SSDEEP 1536:jkmpK1JrbTvTHTxkdfP6BGyOr/+v+ZCQl5Xeq2wpLh5km804m9dD6b8X9:N0TvTHTSl6BXOrGmHOq2Ih5Tem9dD6k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

245966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f

productsrequest.pdf.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

c83a13bdd00c69d549270f03a28a39997ac53b0c2e1f90ead530e96cea81652f

productsrequest.pdf.exe

mscoree

dotnet