Behavioral task
behavioral1
Sample
e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9.exe
Resource
win10v2004-20230220-en
General
-
Target
e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9.zip
-
Size
82KB
-
MD5
c4984d412e9578ce8dc2e6d6951d6644
-
SHA1
b01cf8b96e32fcd9077247a6486a77e2d568089f
-
SHA256
253c92addfd6d5be06a6085d618a9d949fe228829314548f610525e9c9f3f51f
-
SHA512
b87b0b14118e6d833ff223167509e7902eee832650fb899b04a5d2eb08cef803cb46c3221500e9f7c6f018e0b645f7b7fbe218a9477ad6f703e78726649bcdd4
-
SSDEEP
1536:4i2b16U0AVQ2+NxuwcNCh6QUuY7CGUpO0oOV68fACuNQJIP33SUmv+DAIuY2deRk:c05/MdCXxpO2c8fCGIlcY0eRxq
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.walkerdaly.co.za - Port:
587 - Username:
[email protected] - Password:
0^8CE3Z~WE#4 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9.zip.zip
Password: infected
-
e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ