Behavioral task
behavioral1
Sample
0x000e000000012752-74.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0x000e000000012752-74.exe
Resource
win10v2004-20220812-en
General
-
Target
0x000e000000012752-74.dat
-
Size
209KB
-
MD5
374c602e428e3b7a36c9afdf06c44843
-
SHA1
aa2f535673cdca01acf4a050a079e7044593e24a
-
SHA256
796aff80aee41e115a7ab193371b370332ee71b9f58b392bfe1ed7d5ae219e92
-
SHA512
23d94473e3070a77cdd268f8da6aff31e1efa6fa79bad64e4079098eb9dab7e2509d6d02c7b3d0c19264b17160851b676975d374fa92e591c48fb47d469deb62
-
SSDEEP
6144:ex1mbhtN9nXvuU/AZEC3IJU4BA10N85AdmVuxyMJ7h5hlNIsmLVwX:ex1mNcElZGV
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
%2B - Port:
21 - Username:
application/x-www-form-urlencoded - Password:
image/jpg
p=
Signatures
-
Agenttesla family
Files
-
0x000e000000012752-74.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ