Behavioral task
behavioral1
Sample
0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b.exe
Resource
win10v2004-20231127-en
General
-
Target
0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b
-
Size
234KB
-
MD5
d46e60b1428677214fb5301517a5af45
-
SHA1
5e271d7a8a5e0e1ac3a56ae0a5a40c74140a7754
-
SHA256
0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b
-
SHA512
205f26a443ae6fcf1b67a6a2271aa5e496d6ccfe2650035f8a7d28410dfaaf4ae6e412d5484c9263a27cfe05e3a0b3f510d7056f1af6e974adfd605ed1b00365
-
SSDEEP
3072:jcRVplRRNObqG2WUbWnKPdGoMSWb1ATC93O5yhUAkr:jcRVplRRNObqn5bWnQdJMS7C937UB
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
nl10.nlkoddos.com - Port:
587 - Username:
[email protected] - Password:
k[yH!8Z$AE;d - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b
Files
-
0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 231KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ