Behavioral task
behavioral1
Sample
f80c0237002d17b4dbe36c160950f3f5653cf96c08239f071ee79696c3ae3efa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f80c0237002d17b4dbe36c160950f3f5653cf96c08239f071ee79696c3ae3efa.exe
Resource
win10v2004-20231215-en
General
-
Target
f80c0237002d17b4dbe36c160950f3f5653cf96c08239f071ee79696c3ae3efa
-
Size
234KB
-
MD5
bdbf81ada4581a3152154d40aa52d093
-
SHA1
381d8f77e86b41f7ff6f2e8b38e382e9652e2d29
-
SHA256
f80c0237002d17b4dbe36c160950f3f5653cf96c08239f071ee79696c3ae3efa
-
SHA512
55857c0b14aea5e1122a58f9febb1d157afee6c5d89446b7205296289c59dbfebca71460db14cf5805642ec793a389f7794f33a056ce7d9a3ed03ec12957e8e9
-
SSDEEP
6144:000klR1ZlllD8jjfCbBpf0bykreAcqLma1:AklR1ZXlD8jjfCb/f0byOma1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ahlada.com - Port:
587 - Username:
[email protected] - Password:
21rY$9U}48j] - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f80c0237002d17b4dbe36c160950f3f5653cf96c08239f071ee79696c3ae3efa
Files
-
f80c0237002d17b4dbe36c160950f3f5653cf96c08239f071ee79696c3ae3efa.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ