Behavioral task
behavioral1
Sample
ca.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ca.exe
Resource
win10v2004-20220812-en
General
-
Target
ca.exe
-
Size
209KB
-
MD5
72165f5f0a8f235b5ca5df0412739932
-
SHA1
4d442fba2297a278e1d7d16f3ed51bab1b21b767
-
SHA256
ca422a36bb528aae907abe8632c6d59bb4a3d0cf045f17f796fdc52f87f31745
-
SHA512
0c086d2d4835571998e16e9899ffcb537253a5c39cf96a8f20f0a4b263605a54da09f9b46ea2a404fc47d9af59d14d8df678e556f3cb242fe965d0212ddf482e
-
SSDEEP
6144:PPwAWNWsgk6e2mjHXf/UcJwUTMER01MdIxsHU/XuiN2zRBxWe9kRXZ:PPwAWBv/lNNPRkf
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5624004082:AAHVyO088Lf_Yx3daspdkqI3n0UOQ8c-6ng/
Signatures
-
Agenttesla family
Files
-
ca.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ