Behavioral task
behavioral1
Sample
1684921402a9f596dad856df3ab53c7834295304dc0ca18ab3d950721805e7571620cf6fc1365.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1684921402a9f596dad856df3ab53c7834295304dc0ca18ab3d950721805e7571620cf6fc1365.exe
Resource
win10v2004-20230220-en
General
-
Target
1684921402a9f596dad856df3ab53c7834295304dc0ca18ab3d950721805e7571620cf6fc1365.dat-decoded
-
Size
164KB
-
MD5
c875622083bcbf69d9e0394ff4814639
-
SHA1
bdf78c22743c2f83bc2bcb96c4015e5899f998d5
-
SHA256
74d26f4b119393b4528ff36ae1ed9ddf2fd9b6e36f3dbd9c7456ad692687905c
-
SHA512
3c95307e8ad454e54d4d62a7b12f7dbcb79e4eaf9db85449f5a23c988c30e18b6d7215d84b21fddc87da4ea25ae594241966ad07726d938a3d0779a075b293df
-
SSDEEP
3072:beKahm1fHBCEbSpjIJpz+AeXkU/Hg2i3pln:KUFMEbSSTeXkUPA5l
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hermosanairobi.com - Port:
587 - Username:
[email protected] - Password:
mcdsew70@_+lks44 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1684921402a9f596dad856df3ab53c7834295304dc0ca18ab3d950721805e7571620cf6fc1365.dat-decoded
Files
-
1684921402a9f596dad856df3ab53c7834295304dc0ca18ab3d950721805e7571620cf6fc1365.dat-decoded.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ