Behavioral task
behavioral1
Sample
cddca3371378d545e5e4c032951db0e000e2dfc901b5a5e390679adc524e7d9c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cddca3371378d545e5e4c032951db0e000e2dfc901b5a5e390679adc524e7d9c.exe
Resource
win10v2004-20230915-en
General
-
Target
cddca3371378d545e5e4c032951db0e000e2dfc901b5a5e390679adc524e7d9c.exe
-
Size
209KB
-
MD5
0a51b07a37eb44fb6abecc6468f1ba05
-
SHA1
4f087abe56066a73a9aebd70306d14fc6c461d8b
-
SHA256
cddca3371378d545e5e4c032951db0e000e2dfc901b5a5e390679adc524e7d9c
-
SHA512
fd8b178eb4aacb8ea23ff88711904b69438b2e7ed421381b3ec7585496c70c8ddde8cef64eba033abebeade37739b9e2f43320d9c30cb83f548925518cf5e290
-
SSDEEP
3072:A+cj2fu3NtzkduJSJ4vlpg5lIdUef5lGKIaMHwHCRlSGI+51IpQ2F5h64cg:A5jpKiciUef5lGKIBSCRgGIeSD36
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://194.31.98.108/ - Port:
21 - Username:
jdfhhytyt25 - Password:
gfg77we22
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cddca3371378d545e5e4c032951db0e000e2dfc901b5a5e390679adc524e7d9c.exe
Files
-
cddca3371378d545e5e4c032951db0e000e2dfc901b5a5e390679adc524e7d9c.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ