agenttesla | d9d3ab0c8792d0f8e3105b90add9220d[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9d3ab0c8792d0f8e3105b90add9220d.bin
Size

86KB
MD5

a90027e7c1b313dac22948b24e98fbc7
SHA1

9b3f3473975d627c6ec69d07949e3132d277d0d8
SHA256

b1cc9d776de8393730139f54eb9233ec1b9d8d78edda54faad9c0b9ebb3c71e8
SHA512

b63a5df90513379848f3d7d094e53121e6f3593d22a36921c8c62aa0c8bbf933183dde1fc3d5ca3015d62817277ad7b364631b2bfd6eb1e1cc68e4a3b465ffca
SSDEEP

1536:S9Vnia2pVYtWhgByvJteSJCAhQOpVKBZnKPcmIcITBKVg0BV24OghRKl25PBxQLE:SWa2pVY4hMyBsSJCAhQOpGTFcrd72lcN

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pmsgroup.org
Port:
587
Username:
[email protected]
Password:
BlessingAllTheTime
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe

Files

d9d3ab0c8792d0f8e3105b90add9220d.bin
.zip

Password: infected
079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ