Behavioral task
behavioral1
Sample
1684920388e7571a0757221a992b207441c6e91647a7fc440865199298e4228e3e3a66f787295.dat-decoded.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1684920388e7571a0757221a992b207441c6e91647a7fc440865199298e4228e3e3a66f787295.dat-decoded.exe
Resource
win10v2004-20230220-en
General
-
Target
1684920388e7571a0757221a992b207441c6e91647a7fc440865199298e4228e3e3a66f787295.dat-decoded.exe
-
Size
164KB
-
MD5
8cf40b97b6c5ec56ffa381bd2b8e97eb
-
SHA1
87300dfdd78149a8b64c65188a7f91e999e2a79e
-
SHA256
caca5d5339d47737b3e7995ae6bed4b6c2f92a88f7368020726e6ab94726b2eb
-
SHA512
4a8fd4fa27c2b4ac607be757730da4543d4f710909567a76ea823c19bc59bebe78257cb9400a3a7dd9049533107ed97e39a81586dd1d47d7fd75b73ca1a55c1c
-
SSDEEP
3072:syxlFnapumJ13lmUrT2tjNIH5KYpP70DzkYv4IBi:sW+pl13lmsGjkNpP7YX4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
hermosanairobi.com - Port:
587 - Username:
[email protected] - Password:
E?p6m.vDQWn& - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1684920388e7571a0757221a992b207441c6e91647a7fc440865199298e4228e3e3a66f787295.dat-decoded.exe
Files
-
1684920388e7571a0757221a992b207441c6e91647a7fc440865199298e4228e3e3a66f787295.dat-decoded.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ