Behavioral task
behavioral1
Sample
42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992.exe
Resource
win10v2004-20230220-en
General
-
Target
42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992.exe
-
Size
165KB
-
MD5
05688260cd0f68779347d8e274db2597
-
SHA1
a9ebfa0a2da1fb6a81a68c358727df84e0f047c3
-
SHA256
42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992
-
SHA512
2db04c02e2ed7ad864e02ebab3b95a0381b1be3c9860ef3bca170f108be810db956f00d32dcce81fe1a99b3329d1c343967b2053905edbf206cde07375008e82
-
SSDEEP
3072:PG/1o5GVEFx9nj1r8VWn3DjR5xf9dZRYa0ujEsxt/DwQnckuYCKFBsnVYTI:IEFxhpr0g3hXf9d8a0ujE+p8RbYPrsV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.exceltruea.com - Port:
587 - Username:
[email protected] - Password:
bl es si ng 2 0 2 3 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992.exe
Files
-
42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ