Behavioral task
behavioral1
Sample
next.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
next.exe
Resource
win10v2004-20230220-en
General
-
Target
next.bin
-
Size
164KB
-
MD5
9783af52b7cec4df1864716f78c91d4d
-
SHA1
3af40585b55e81bf6ac798b686d1872930bfcde0
-
SHA256
befe5338e8e2bb2217e837e6c8ad55f710cffd7a3513f4d284cbc80488d73cc2
-
SHA512
7767d67c088a72b94573c6aac5286190f716188586cae5da54e26433f83864ef55cfa9ec0c54ecc6a6f2091e9335539090e9464092929db4d6d35e12ca04f274
-
SSDEEP
3072:fFB1D6A/ppgWo1wp13naIbyJMJrVJ/jVhDwiemaQuNt26fkG7o:fFBXppLCmVaI+JMTJhqiezNDL7
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6287986251:AAGCSj3TAzwv7sCC7X0DmHgcs3euo4j9_Ww/
Signatures
-
Agenttesla family
Files
-
next.bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ