Behavioral task
behavioral1
Sample
663708_drop.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
663708_drop.exe
Resource
win10v2004-20220812-en
General
-
Target
663708_drop.exe_
-
Size
208KB
-
MD5
a5058349ef89c57bb6ba251e014db0fd
-
SHA1
affdefc397fe6c3097e2182662e48288b325d54e
-
SHA256
bdd83a4037c627080060437d016be408cfcde0df6ce3767b6273d8d4573ab9bd
-
SHA512
0a88d279aaf52ccd95878f73e1e81a9a0d080d0a21c8f2bbbe318805e473af18a3c6c35a7a520b988edaffb2b41879c6cb795eb9209803f54c69df8bc2b114d6
-
SSDEEP
6144:GgH7WZVmhYa9ZzUklUXRUb4/5CXy7eL2j4XsEb7xkCyi:GgHkVmhYa9ZT2XztC
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
%2B - Port:
21 - Username:
application/x-www-form-urlencoded - Password:
image/jpg
p=
Signatures
-
Agenttesla family
Files
-
663708_drop.exe_.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ