AgentTesla PE Executable malware analysis – f71bfe3c2b4f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

2 malicious · 100 files

EXEf71bfe3c2b4f732b4fd498ba8d88d224AgentTesla

Structure

BINResources

BIN.Net Resources

BINRoblox_Executor.Form1.resources

BINK1X6O2J0FoDMjgpGaq.fbGE3rTwdn22mu1W3k

BINcostura.costura.dll.compressed

DLLcostura.costura.dll

BINcostura.costura.pdb.compressed

PDBcostura.costura.pdb

BINApLAbcw7pEtpO9EWnr.xpLE4XCZChrqNuXb52

BINcostura.guna.ui2.dll.compressed

DLLcostura.guna.ui2.dllAgentTesla

Structure

P7B[Authenticode]_28203e69.p7b

BINResources

BIN.Net Resources

BINcostura.metadata

BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources

BINRoblox_Executor.Properties.Resources.resources

Name	Value
Info	PDB Path: Roblox Executor.pdb
Module Name	Roblox Executor.exe
Full Name	Roblox Executor.exe
EntryPoint	System.Void xNL4QlwxrBWrRpi31TH.mimRpcwdMs84pHGeBf5::qKewRIHPMB()
Scope Name	Roblox Executor.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Roblox Executor
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	46
Main Method	System.Void xNL4QlwxrBWrRpi31TH.mimRpcwdMs84pHGeBf5::qKewRIHPMB()
Main IL Instruction Count	36
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_008D: ldc.i4.0 newobj System.Void Roblox_Executor.Form2::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 3 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) ret <null> call System.Void PSKnKOs92GNlqdct6Sm.jMek02sRixfCkWDyy2v::wIKyL47ink() ldc.i4 2 ldsfld <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b} <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_5cf7271bf6254e5cb614097029141591 ldfld System.Int32 <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_a39b4e4697cb4e8281eedfc58d410294 brtrue IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) pop <null> ldc.i4 0 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 0 ldsfld <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b} <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_5cf7271bf6254e5cb614097029141591 ldfld System.Int32 <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_aafeac4bcd6049d49cf457d2a641d4f6 brtrue IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) pop <null> ldc.i4 0 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 4 ldsfld <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b} <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_5cf7271bf6254e5cb614097029141591 ldfld System.Int32 <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_0cb6e94a020f47328310a6ebaae10e79 brtrue IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) pop <null> ldc.i4 0 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045)
Module Name	Roblox Executor.exe
Full Name	Roblox Executor.exe
EntryPoint	System.Void xNL4QlwxrBWrRpi31TH.mimRpcwdMs84pHGeBf5::qKewRIHPMB()
Scope Name	Roblox Executor.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Roblox Executor
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	46
Main Method	System.Void xNL4QlwxrBWrRpi31TH.mimRpcwdMs84pHGeBf5::qKewRIHPMB()
Main IL Instruction Count	36
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_008D: ldc.i4.0 newobj System.Void Roblox_Executor.Form2::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 3 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) ret <null> call System.Void PSKnKOs92GNlqdct6Sm.jMek02sRixfCkWDyy2v::wIKyL47ink() ldc.i4 2 ldsfld <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b} <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_5cf7271bf6254e5cb614097029141591 ldfld System.Int32 <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_a39b4e4697cb4e8281eedfc58d410294 brtrue IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) pop <null> ldc.i4 0 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 0 ldsfld <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b} <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_5cf7271bf6254e5cb614097029141591 ldfld System.Int32 <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_aafeac4bcd6049d49cf457d2a641d4f6 brtrue IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) pop <null> ldc.i4 0 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 4 ldsfld <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b} <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_5cf7271bf6254e5cb614097029141591 ldfld System.Int32 <Module>{2c8b5b2c-d4ca-4e4e-91bd-cc61f136872b}::m_0cb6e94a020f47328310a6ebaae10e79 brtrue IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045) pop <null> ldc.i4 0 br IL_0012: switch(IL_008D,IL_0069,IL_0030,IL_0044,IL_0045)