Behavioral task
behavioral1
Sample
64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05.exe
Resource
win10v2004-20230220-en
General
-
Target
64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05.exe
-
Size
167KB
-
MD5
cc9165270dbf72f86af906f7ed22f818
-
SHA1
ce10e92c7afe84339a8d955b2b6572ee23f07ced
-
SHA256
64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05
-
SHA512
6528b566102fd653303a35e8e7af6d388b299ce6cb570707a895454b2c2079646d5940aca802bb0b212ce76c76d92910acc280b6ae9ed0b3cdb4288a985a8bbe
-
SSDEEP
3072:62spuL9wKXqiCS2zAe41lVAzu3Q1hSFcuWA7fatrg7R8GMkaf:6JmC3hzAH1lwz1hm5itIHa
Malware Config
Extracted
agenttesla
https://discordapp.com/api/webhooks/1073339610417074269/QcF6VBtXQ21Lmb_c5HCW2fvUeTIxvp9rOkGo3hWjI5xl7LahuuVlPvjElqiKR3GK2dYC
Signatures
-
Agenttesla family
Files
-
64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ