Behavioral task
behavioral1
Sample
0c09351d-cd33-45fd-95b0-ac3dff3f8565.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0c09351d-cd33-45fd-95b0-ac3dff3f8565.exe
Resource
win10v2004-20220812-en
General
-
Target
0c09351d-cd33-45fd-95b0-ac3dff3f8565.exe
-
Size
209KB
-
MD5
c5a10f89a3d7a279270f66926e292657
-
SHA1
16a4a1b6b1f03d7a725f9428cd0edb6a1bcd05f5
-
SHA256
ee37c95d10c93066599d6de775cc3b91503feff1509d12257fa5c83e7875e0f1
-
SHA512
929aaa278cdfbc509cd32de1f8afa4240215dad6ba82fe0ec9aa683ebfdbdb01f81c4d044c813198769577a298e5e2c8f0623b09723606dcc9e4cb819f0303e2
-
SSDEEP
6144:qpbeWrZapY0+c5ykA+3c9G2WGUD0vyHuTuTOVChPqQeRX5INX:qpbeWrI5cXJI
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
%2B - Port:
21 - Username:
application/x-www-form-urlencoded - Password:
image/jpg
p=
Signatures
-
Agenttesla family
Files
-
0c09351d-cd33-45fd-95b0-ac3dff3f8565.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ