Behavioral task
behavioral1
Sample
62766ca631dd4d6305ca7bb85b94178323ea633c9d76ecab723ef84e6aba28f6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
62766ca631dd4d6305ca7bb85b94178323ea633c9d76ecab723ef84e6aba28f6.exe
Resource
win10v2004-20221111-en
General
-
Target
62766ca631dd4d6305ca7bb85b94178323ea633c9d76ecab723ef84e6aba28f6
-
Size
209KB
-
MD5
6657eaec98e93cdc7d2947b38d4c2f10
-
SHA1
8758896087fe070c2aeb8df5e2f00d20a1348923
-
SHA256
62766ca631dd4d6305ca7bb85b94178323ea633c9d76ecab723ef84e6aba28f6
-
SHA512
886f44c8c35e0440e0a6ea826566f94fd4da9718345c9f9d2faad72f67c9fbc5328c097b52941fccaf09b09af97d536609ba2b1b912d7fc2b4d1f5da82fc0291
-
SSDEEP
3072:rqgIBi2d5KAOwLdy2a8xoUMahU/9S2UzgyjR+PSrb3av/j/q7jwhK+mrwM:Wg4hdy2a8ZxU/9S2UL+6rbaHDyw4+
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.valvulasthermovalve.cl/ - Port:
21 - Username:
[email protected] - Password:
LILKOOLL14!!
Signatures
-
Agenttesla family
Files
-
62766ca631dd4d6305ca7bb85b94178323ea633c9d76ecab723ef84e6aba28f6.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ