Static task
static1
Behavioral task
behavioral1
Sample
09000000090900.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
09000000090900.exe
Resource
win10v2004-20220414-en
General
-
Target
b9ac9a6dc4bce3231fc93ea237a4ab5251359e2de9d1beae7c49d7b2fafa9d93
-
Size
266KB
-
MD5
4aa24fa69bace311b56ed925048dde9b
-
SHA1
2da056f92946aa5b39110cba9ca65c22cc84f26f
-
SHA256
b9ac9a6dc4bce3231fc93ea237a4ab5251359e2de9d1beae7c49d7b2fafa9d93
-
SHA512
113a8f0481071e8a7d9859c75fc72846535efc8e06150bd69bb214327078dd05fcb98aa0e63903698b5b37116d795a57d4765f98a7e86ce20cf362d4b3f3742e
-
SSDEEP
6144:nLkzlHsUUezFnjohos95EZIvmr/M4QQzLUN1WKhUeSZrAPfDxVEW:LulMXaih59iZq+M4QQMrhiEDx3
Malware Config
Signatures
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/09000000090900.exe family_agenttesla -
Agenttesla family
Files
-
b9ac9a6dc4bce3231fc93ea237a4ab5251359e2de9d1beae7c49d7b2fafa9d93.zip
-
09000000090900.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 616KB - Virtual size: 615KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ