Behavioral task
behavioral1
Sample
e813cf0423b14dcc9ae4ad8bd570423a.exe
Resource
win10v2004-20220812-en
General
-
Target
6da7cb41b312bfbbcd4fbc3641d3418f-sample.zip
-
Size
101KB
-
MD5
c2057ff1c5cc8e7909e8cb1e3d744dc7
-
SHA1
4681ac014293f335fce8c8ce04044f00e62b1518
-
SHA256
f11c868f8e88c1970eb6daf2b6f70048de332f9abce8a652d81689570be330a7
-
SHA512
b8abaedb3b02c7f08e74a62e57d8816ae8deca244cbb1bdb89685c8ea48b125615464238cb8b4993be340ba2fef9b0d7116ec3cb67fc1e68c0585409dc79ad66
-
SSDEEP
3072:jbM9ZcinD5xtw+9mJuyKAfiJFp61t+PhjJ:0LnD5zv+862z
Malware Config
Extracted
agenttesla
http://195.178.120.72/fab4/inc/2a5129e6823d71.php
Signatures
-
Agenttesla family
Files
-
6da7cb41b312bfbbcd4fbc3641d3418f-sample.zip.zip
Password: infected
-
e813cf0423b14dcc9ae4ad8bd570423a.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ