Static task
static1
Behavioral task
behavioral1
Sample
RFQ__PR_.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
RFQ__PR_.exe
Resource
win10-en-20211208
General
-
Target
60d64391a2d2632f20b0861d2f74f6568fb70bcceedfaf998db1d88ad4a4cc81
-
Size
1.5MB
-
MD5
5a6063f82f30891759b87451ece26282
-
SHA1
f84bdf14cba2537e0ce95f3fcc5ba4f69033d94a
-
SHA256
60d64391a2d2632f20b0861d2f74f6568fb70bcceedfaf998db1d88ad4a4cc81
-
SHA512
5e99628aa2ef807f7ae594118242ab9f0ec78cc69efb7f79a5dd709eb8dbfeb077414266c3f042e466c0be6b065c479ac2ea9007bf4516c02b852ba5efa84245
-
SSDEEP
6144:DBPYE9q5mH0MFZS4OM5vlqAMBr/wYQv0H5mBuxrSWk0dmez6s/vuGkfqerynu8V:SE9q60oS4OM5dqAoErfKr6wXkbevW2T
Malware Config
Signatures
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule sample family_agenttesla static1/unpack001/RFQ__PR_.EXE family_agenttesla -
Agenttesla family
Files
-
60d64391a2d2632f20b0861d2f74f6568fb70bcceedfaf998db1d88ad4a4cc81.iso
-
RFQ__PR_.EXE.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 886KB - Virtual size: 886KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ