agenttesla | 5fc07e38a7bcddcb8ff232ed1fd745770237510f66a60b3a9d71995000084cff | Triage

Sharing

General

Target

5fc07e38a7bcddcb8ff232ed1fd745770237510f66a60b3a9d71995000084cff
Size

305KB
MD5

42737ecb50ef620fd54228e15f98efb4
SHA1

3a50bc5b575456774b7a7cbc0208e9aad6e5b210
SHA256

5fc07e38a7bcddcb8ff232ed1fd745770237510f66a60b3a9d71995000084cff
SHA512

8de4fd4ba618d2b354db29b3d651ed2e2e00d7a2af7cb89e868636ac8727bd332a38fde757f955030c9d55b5909991a1361aa5d38526bd40ecf1db146d2fbe4a
SSDEEP

6144:AWbtJthtBOoIhv3n/FecQB/laul5Ts0Ol:AItJthtBw/n9ecwTI0O

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
phoenixblowers.com
Port:
587
Username:
[email protected]
Password:
Officeback@2022#
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5fc07e38a7bcddcb8ff232ed1fd745770237510f66a60b3a9d71995000084cff

Files

5fc07e38a7bcddcb8ff232ed1fd745770237510f66a60b3a9d71995000084cff
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 302KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ