Behavioral task
behavioral1
Sample
98c22c74f41003c443c1e26b72e3e1d4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
98c22c74f41003c443c1e26b72e3e1d4.exe
Resource
win10v2004-20231215-en
General
-
Target
98c22c74f41003c443c1e26b72e3e1d4
-
Size
216KB
-
MD5
98c22c74f41003c443c1e26b72e3e1d4
-
SHA1
0593cb3664926b9fe022c05d7a437ab83f73f6cc
-
SHA256
48b05619f4c896877630fa73041518ff25a11d99fb4b12d937dfeba0612c37f8
-
SHA512
52d4ba8bf52e48552916d8ab2aba27f7b30caec8f7b285201fa6f8415ceb5ecdc032d17db595efaa361ceb74925110e26f16e1cef44aba568721b90031e8cf3c
-
SSDEEP
3072:K9Wrp3e8ZrtnhRm3LpUsbPCXm2OkuiYiw+KcniBKb7Aj5QT4cjn6FFUyt5T2/:K6nhY1UlXPOUwngSKQj5Q0cTWeO5T
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.impressindia.net - Port:
587 - Username:
[email protected] - Password:
iTE]4_=o~XA)
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98c22c74f41003c443c1e26b72e3e1d4
Files
-
98c22c74f41003c443c1e26b72e3e1d4.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 214KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ