Behavioral task
behavioral1
Sample
9a157353e20d338997d5e016266bbd58.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9a157353e20d338997d5e016266bbd58.exe
Resource
win10v2004-20220901-en
General
-
Target
9a157353e20d338997d5e016266bbd58.exe
-
Size
210KB
-
MD5
9a157353e20d338997d5e016266bbd58
-
SHA1
9c20c9ddc9b2707990d267bbd59e8b6d3b46e642
-
SHA256
104af60f7d2f1351535ad148b29ba12bb139d2af518417ce8455abcb17662ebd
-
SHA512
b88ba8b90d61118c2435b6207af71c80ac5e3583e2f9ac1642500ac569f3896cd35182e3b9b7d96b028a48d488428f1b87495067a2ec5da7d776a02f7dc5159f
-
SSDEEP
6144:IgwZP/U0qyAyHfJlJFNCoj0/aO+UrQJ7ghoFoVIj0XW4XYXjLpKi01jmXPr+h1Sa:IgwV/U0dNdj0WcYXjLn+1
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
%2B - Port:
21 - Username:
application/x-www-form-urlencoded - Password:
image/jpg
p=
Signatures
-
Agenttesla family
Files
-
9a157353e20d338997d5e016266bbd58.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ