4150a9254130775146e1973ba461ffacc7d51365da70db48becba50fbfc1e39d.exe Trojan AgentTesla Analysis
| Online Virus Checker | v.1.0.170.174 |
| DB Version: | 2024-03-27 16:00:23 |
Trojan.Win32.AgentTesla.tr
AgentTesla is a Remote Access Trojan (RAT) built on the .Net framework, primarily utilized to acquire initial access to systems. It's frequently employed within the framework of Malware-As-A-Service (MaaS). Within this illicit business model, individuals referred to as "initial access brokers" (IAB) offer their specialized expertise to criminal groups seeking to exploit corporate networks. As an initial-stage malware, AgentTesla facilitates remote access to a compromised system, subsequently permitting the downloading of more advanced secondary tools, including ransomware.
| File | 4150a9254130775146e1973ba461ffacc7d51365da70db48becba50fbfc1e39d.exe |
| Checked | 2024-03-27 16:32:39 |
| MD5 | 8670ff57444ced9cc643f4588e41a93e |
| SHA1 | 7195dc5aeda6f7f88e32e3aab2c696959c4e42a5 |
| SHA256 | 4150a9254130775146e1973ba461ffacc7d51365da70db48becba50fbfc1e39d |
| SHA512 | d4948994ac3dfb526a0b03b8c3d442c4254f2145fbe3574f45e4b4bd5ddbc575870ad261de7f92a351808ecb1c8b62ea9c4e86c69ae945c4cb8cccf090c5c0fd |
| Imphash | 21371b611d91188d602926b15db6bd48 |
| File Size | 727552 bytes |
Trojan.Win32.AgentTesla.tr Removal
Gridinsoft has the capability to identify and eliminate Trojan.Win32.AgentTesla.tr without requiring further user intervention.
- Start by downloading Gridinsoft Anti-Malware to your computer.
- Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
- Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
- Click on the "Standard Scan" button.
- After the scanning process is finished, click on "Clean Now" to remove any detected threats.
- If prompted, restart your system to complete the removal process.
File Version Information
| Translation | 0x0809 0x04b0 |
Portable Executable Info
 |
9da43802a501b36633fc7dafecfd8926 a1548419a3b0bc43f0f75c4349adda8a eccc8c94d4d8e8f4 |
| Image Base: | 0x00400000 |
| Entry Point: | 0x00539700 |
| Compilation: | 2024-03-26 01:45:21 |
| Checksum: | 0x00000000 (Actual: 0x000bcf15) |
| OS Version: | 5.1 |
| PEiD: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 3 |
| Imports: | KERNEL32, ADVAPI32, COMCTL32, COMDLG32, GDI32, IPHLPAPI, MPR, ole32, OLEAUT32, PSAPI, SHELL32, USER32, USERENV, UxTheme, VERSION, WININET, WINMM, WSOCK32, |
| Exports: | 0 |
| Resources: | 21 |
Sections
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Entropy |
|---|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x000dc000 | 0x00000000 | d41d8cd98f00b204e9800998ecf8427e | 0.00 |
| UPX1 | 0x000dd000 | 0x0005d000 | 0x0005ca00 | 3c7be0508858290b14256ae5962a8191 | 7.94 |
| .rsrc | 0x0013a000 | 0x00055000 | 0x00054c00 | 16b00345020cf8b1032acc65088254c0 | 7.98 |
