Behavioral task
behavioral1
Sample
3040-60-0x00000000402F0000-0x000000004034C000-memory.exe
Resource
win7-20231215-en
General
-
Target
3040-60-0x00000000402F0000-0x000000004034C000-memory.dmp
-
Size
368KB
-
MD5
ae975ba1851990015dc9bd347ee179fd
-
SHA1
16cc2f91e385605c3302e4cb719d59c4c281b39f
-
SHA256
5dca6fc45cc2e4c4ff978fa2de059f689d4de9704c0c5d1b5bde8764fa14fe68
-
SHA512
d04a94b1ea70cd67e0dd6a6dae8002777cfce3d86b7827de9866917b0a4fbade0281bce05cd2dded0bf44cd0ce951209a002356a8de380e356e6b2a7430cc9bd
-
SSDEEP
6144:W70RDJaMMUTTXr3DyeCTRu+J5iEvAbE2aw4uay:U0RDJaMMUTTXr3DXClEEvjKz
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oripam.xyz - Port:
587 - Username:
[email protected] - Password:
231Father@ - Email To:
[email protected]
Extracted
asyncrat
0.5.8
Default
139.84.229.159:2017
jhT6lZT93vW5
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Agenttesla family
-
Async RAT payload 1 IoCs
resource yara_rule sample asyncrat -
Asyncrat family
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3040-60-0x00000000402F0000-0x000000004034C000-memory.dmp
Files
-
3040-60-0x00000000402F0000-0x000000004034C000-memory.dmp.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 343KB - Virtual size: 342KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ