agenttesla | d9d3ab0c8792d0f8e3105b90add9220d[.]bin

General

Target
d9d3ab0c8792d0f8e3105b90add9220d.bin
Size 86KB
Sample240614-dftsnasfrf
SHA256 b1cc9d776de8393730139f54eb9233ec1b9d8d78edda54faad9c0b9ebb3c71e8
MD5 a90027e7c1b313dac22948b24e98fbc7
SHA1 9b3f3473975d627c6ec69d07949e3132d277d0d8
SHA512 b63a5df90513379848f3d7d094e53121e6f3593d22a36921c8c62aa0c8bbf933183dde1fc3d5ca3015d62817277ad7b364631b2bfd6eb1e1cc68e4a3b465ffca
SSDEEP 1536:S9Vnia2pVYtWhgByvJteSJCAhQOpVKBZnKPcmIcITBKVg0BV24OghRKl25PBxQLE:SWa2pVY4hMyBsSJCAhQOpGTFcrd72lcN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.pmsgroup.org
Port
587
Username
[email protected]
Password
BlessingAllTheTime
Email to
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe

File Explorer

d9d3ab0c8792d0f8e3105b90add9220d.bin

.zip 86KB
079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe

.exe 245KB

d9d3ab0c8792d0f8e3105b90add9220d.bin

SHA256 b1cc9d776de8393730139f54eb9233ec1b9d8d78edda54faad9c0b9ebb3c71e8
MD5 a90027e7c1b313dac22948b24e98fbc7
SHA1 9b3f3473975d627c6ec69d07949e3132d277d0d8
SHA512 b63a5df90513379848f3d7d094e53121e6f3593d22a36921c8c62aa0c8bbf933183dde1fc3d5ca3015d62817277ad7b364631b2bfd6eb1e1cc68e4a3b465ffca
SSDEEP 1536:S9Vnia2pVYtWhgByvJteSJCAhQOpVKBZnKPcmIcITBKVg0BV24OghRKl25PBxQLE:SWa2pVY4hMyBsSJCAhQOpGTFcrd72lcN
MD5 SHA1 SHA512 SSDEEP

Password

infected

079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9
MD5 d9d3ab0c8792d0f8e3105b90add9220d
SHA1 6fc2ee6e78a45b5eb266cddb00c04d16295236e6
SHA512 542a075846f60d3565a64d3dac21988eeec17fc35d48b33e148338a95aebc1181a275e3045f9e65d818fc90b1e1ac436d91ec5bb1a24b759d179a7642db05c82
SSDEEP 3072:lXk4UQkbX4TZfRJTA4XIctWICnz5UlJiN5c3+E:Rk4UQkbX4TZfRKgWIgUJi/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

256286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d9d3ab0c8792d0f8e3105b90add9220d.bin

079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

d9d3ab0c8792d0f8e3105b90add9220d.bin

079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe

mscoree

dotnet