Behavioral task
behavioral1
Sample
d2a0f82d79f253c9a866e491413c7dece234a4f8cba92b29106cecd2b0b994c7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d2a0f82d79f253c9a866e491413c7dece234a4f8cba92b29106cecd2b0b994c7.exe
Resource
win10v2004-20240226-en
General
-
Target
d2a0f82d79f253c9a866e491413c7dece234a4f8cba92b29106cecd2b0b994c7
-
Size
245KB
-
MD5
d6a7ab35c6063338683a61ea0617f58d
-
SHA1
42768f52a214a2da25f867e4f8499acee6c44461
-
SHA256
d2a0f82d79f253c9a866e491413c7dece234a4f8cba92b29106cecd2b0b994c7
-
SHA512
8a3028d9cabb0d5ecd9207367174035eb57b19d25ce2aad5b14ede1b65bbeacdcfc7ec0e49c49a5875fda52e372774da2757f38e7ea1372a9314f6ef68f9a665
-
SSDEEP
3072:q99lSaerwsdlxBi5HkiBjvnZ6jZXEa5fIZ172//:q97Saerwsnxuk2DnoREjZ4/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mez.com.tr - Port:
587 - Username:
[email protected] - Password:
Ey25tK - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2a0f82d79f253c9a866e491413c7dece234a4f8cba92b29106cecd2b0b994c7
Files
-
d2a0f82d79f253c9a866e491413c7dece234a4f8cba92b29106cecd2b0b994c7.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 242KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ