Behavioral task
behavioral1
Sample
797fb982e8a6984533ca9677ffff090d859f36721cde3cc32749d7c4dd3e69f5.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
797fb982e8a6984533ca9677ffff090d859f36721cde3cc32749d7c4dd3e69f5.exe
Resource
win10v2004-20240419-en
General
-
Target
797fb982e8a6984533ca9677ffff090d859f36721cde3cc32749d7c4dd3e69f5
-
Size
244KB
-
MD5
7752148ebe0c1182c2d927ded6d3e534
-
SHA1
8a563266c0c342f446f334b51123638988567285
-
SHA256
797fb982e8a6984533ca9677ffff090d859f36721cde3cc32749d7c4dd3e69f5
-
SHA512
7b247d05ec5e6a677febbca93ff8d667c35bcf47c92a8d0c41c1fcd60eb7689235775f5b93822126cffa468bf19db61f993a21a881b809830a252fea3a66c662
-
SSDEEP
3072:9mn8x1B9BikwLsLLtda4u6k29VHX5N5KQnRjyO:9C8x1B9Bikq6/9VHJxnNy
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
nghu nilb hsoq nedv - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 797fb982e8a6984533ca9677ffff090d859f36721cde3cc32749d7c4dd3e69f5
Files
-
797fb982e8a6984533ca9677ffff090d859f36721cde3cc32749d7c4dd3e69f5.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ