Behavioral task
behavioral1
Sample
0x00080000000122e0-66.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0x00080000000122e0-66.exe
Resource
win10v2004-20220901-en
General
-
Target
0x00080000000122e0-66.dat
-
Size
211KB
-
MD5
993c330b4f0e94b46664f2f0bf3309c2
-
SHA1
39927969b78ab13d5fe3a3888145204a1e13afd8
-
SHA256
6aba8a03fd93b96c073cfc3cd2801926f9a6f25bc2afb95a686237e6900a184e
-
SHA512
a0c38f039d21bda0a800b5453d3e96bc5e8ef0b9bdc4756756b426de866f288e5dd25ea449faf48e61c535a9b0942993467976d350da37f0f55f9af9828af186
-
SSDEEP
6144:uRcgcB5Uf58MxFTEG4BQlqUrKVooJ3CaInx5+tUm:uRcHB5k58MxFTErMBx5+9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.waterchem.com.tr - Port:
587 - Username:
[email protected] - Password:
,A26dsH,[D)x - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
0x00080000000122e0-66.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 208KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ