Behavioral task
behavioral1
Sample
006bd85271b32635be501838ee318c3c5b4b60712be796cd2a95556b7ed501d4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
006bd85271b32635be501838ee318c3c5b4b60712be796cd2a95556b7ed501d4.exe
Resource
win10v2004-20220812-en
General
-
Target
006bd85271b32635be501838ee318c3c5b4b60712be796cd2a95556b7ed501d4
-
Size
215KB
-
MD5
5287a447a7a49e8eec5cba65b7c5ba52
-
SHA1
94e2cd1f1a9473b7ed9a72b5d5c2875bd0f5abd4
-
SHA256
006bd85271b32635be501838ee318c3c5b4b60712be796cd2a95556b7ed501d4
-
SHA512
5ebd9f72f6d94514cafb7e11d8226c9d14accdf4aa4ff464a8aec2ccea91c593f88720f6cc41a77bc2508021f51411f41e31a1fda27ec0d49716af544bf843c6
-
SSDEEP
3072:rmQMgmhHDPhqUIhDUvEaURCRsX3EpOX9VuOgNiSNI8Zpd0Eq4Nn8byWQnwYUBwk:rYhmU60RsU2VuOnyIIAE8b8VUB
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mgcpakistan.com/ - Port:
21 - Username:
[email protected] - Password:
boygirl123456
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
Files
-
006bd85271b32635be501838ee318c3c5b4b60712be796cd2a95556b7ed501d4.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 213KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ