Behavioral task
behavioral1
Sample
631ba21d543678ab025037ad8f53cfb354f097c6bf580019be33a3364019c525.exe
Resource
win7-20240508-en
General
-
Target
631ba21d543678ab025037ad8f53cfb354f097c6bf580019be33a3364019c525
-
Size
300KB
-
MD5
4990d5be4b737ada6ac3b70ac9579054
-
SHA1
1790ca8f04ff2cb3ee92c6a1d29855b30343511f
-
SHA256
631ba21d543678ab025037ad8f53cfb354f097c6bf580019be33a3364019c525
-
SHA512
22d99a81e8ded9923101864b715eea3cd99a81a1ef19647eda18de711eb5e4add61d6fadba2a36887af6802ba75d0fd8ce26a92fa59de73d30b615e9e7469703
-
SSDEEP
6144:vmhwqSIB8yXHtcoFa7XcM4qa3IB0H1V2xiYq42FrcsqGJlmYb:vC6IBFteXJ0/EAL2GJ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.flood-protection.org - Port:
587 - Username:
[email protected] - Password:
emmydon2424@
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 631ba21d543678ab025037ad8f53cfb354f097c6bf580019be33a3364019c525
Files
-
631ba21d543678ab025037ad8f53cfb354f097c6bf580019be33a3364019c525.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 298KB - Virtual size: 297KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ