agenttesla | InstallUtil_exe_PIDf24_InstallUtil[.]exe_400000_x86[.]exe | Triage

Sharing

General

Target

InstallUtil_exe_PIDf24_InstallUtil.exe_400000_x86.exe
Size

264KB
MD5

aa42412f68b45b4239642b70e77f5650
SHA1

2edbf5cd0c49433807d828ab72fb2dc18ed90973
SHA256

fb8bea0350766a97ad53467bad9e916c5e8f50d4c7956d455182ab29374d1962
SHA512

c4f602bbdef1e90d2085c1330f126ac518049baa33cd3c7902f3e36721a505e5e4f1a449a097771d8aecb9cdc9729906d46aef0273a70306fa363686ef5fe778
SSDEEP

1536:V9Tyzlxf7vj1TD7b87c5Qmb8XCuCqyW/kqqJHkn4Byq5Xbgc9XmJI3wZ2/eK:vKrf7vj1TPbccVbXWxunyq5rgSmJIv

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
manlikeyou88
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallUtil_exe_PIDf24_InstallUtil.exe_400000_x86.exe

Files

InstallUtil_exe_PIDf24_InstallUtil.exe_400000_x86.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ