AgentTesla PE Executable malware analysis – 5838cb23489e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

2 malicious · 78 files

EXE5838cb23489e11a4a1d36f8870adff4dAgentTesla

Structure

BINResources

BIN.Net Resources

BINqxnt6SUOA1v83stWYq.6teH5ddxREjnc7aEqY

BINSyntex_Spoofer.Menu.resources

BINcostura.costura.dll.compressed

DLLcostura.costura.dll

BINcostura.costura.pdb.compressed

PDBcostura.costura.pdb

BINcostura.guna.ui2.dll.compressed

DLLcostura.guna.ui2.dllAgentTesla

Structure

P7B[Authenticode]_28203e69.p7b

BINResources

BIN.Net Resources

BINcostura.metadata

BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources

BINFr8wdethB7ecRQXp2I.egctEM3FQXE199I6nH

Name	Value
Info	PDB Path: Syntex Spoofer.pdb
Module Name	Syntex Spoofer.exe
Full Name	Syntex Spoofer.exe
EntryPoint	System.Void dZfm5hq7EpQZmC67nD.hFVDIyQgo3eFMr0i6G::TeSSdIds4()
Scope Name	Syntex Spoofer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Syntex Spoofer
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	44
Main Method	System.Void dZfm5hq7EpQZmC67nD.hFVDIyQgo3eFMr0i6G::TeSSdIds4()
Main IL Instruction Count	36
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0030: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 4 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 0 ldsfld <Module>{b0190f00-605c-4317-b4bc-75089167ec59} <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_967f1b9912a046a39be621c005ef29b2 ldfld System.Int32 <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_b710c9089e0e4b5fb57d0e20286a4202 brtrue IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) pop <null> ldc.i4 0 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) newobj System.Void Syntex_Spoofer.Menu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 3 ldsfld <Module>{b0190f00-605c-4317-b4bc-75089167ec59} <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_967f1b9912a046a39be621c005ef29b2 ldfld System.Int32 <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_d410cf12cb864c9d9077341b40a4387f brfalse IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) pop <null> ldc.i4 3 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) ret <null> call System.Void JWL4JwdZVfSQfMLkLZD.I83H4HdSQ0knqW5GEu4::O52BdxPqBL() ldc.i4 2 ldsfld <Module>{b0190f00-605c-4317-b4bc-75089167ec59} <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_967f1b9912a046a39be621c005ef29b2 ldfld System.Int32 <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_f8fc07b2dbc94384848d1963035ca8ab brfalse IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) pop <null> ldc.i4 1 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E)
Module Name	Syntex Spoofer.exe
Full Name	Syntex Spoofer.exe
EntryPoint	System.Void dZfm5hq7EpQZmC67nD.hFVDIyQgo3eFMr0i6G::TeSSdIds4()
Scope Name	Syntex Spoofer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Syntex Spoofer
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	44
Main Method	System.Void dZfm5hq7EpQZmC67nD.hFVDIyQgo3eFMr0i6G::TeSSdIds4()
Main IL Instruction Count	36
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0030: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 4 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 0 ldsfld <Module>{b0190f00-605c-4317-b4bc-75089167ec59} <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_967f1b9912a046a39be621c005ef29b2 ldfld System.Int32 <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_b710c9089e0e4b5fb57d0e20286a4202 brtrue IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) pop <null> ldc.i4 0 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) newobj System.Void Syntex_Spoofer.Menu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 3 ldsfld <Module>{b0190f00-605c-4317-b4bc-75089167ec59} <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_967f1b9912a046a39be621c005ef29b2 ldfld System.Int32 <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_d410cf12cb864c9d9077341b40a4387f brfalse IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) pop <null> ldc.i4 3 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) ret <null> call System.Void JWL4JwdZVfSQfMLkLZD.I83H4HdSQ0knqW5GEu4::O52BdxPqBL() ldc.i4 2 ldsfld <Module>{b0190f00-605c-4317-b4bc-75089167ec59} <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_967f1b9912a046a39be621c005ef29b2 ldfld System.Int32 <Module>{b0190f00-605c-4317-b4bc-75089167ec59}::m_f8fc07b2dbc94384848d1963035ca8ab brfalse IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E) pop <null> ldc.i4 1 br IL_0012: switch(IL_0030,IL_0040,IL_0064,IL_008D,IL_008E)