Behavioral task
behavioral1
Sample
c6c6ac8c5d381252b12c59d663a95a3b6c3a13e229c53d2dc637fd76821aabff.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c6c6ac8c5d381252b12c59d663a95a3b6c3a13e229c53d2dc637fd76821aabff.exe
Resource
win10v2004-20240226-en
General
-
Target
c6c6ac8c5d381252b12c59d663a95a3b6c3a13e229c53d2dc637fd76821aabff
-
Size
245KB
-
MD5
754fe9213224e7a3f031b4b57820c422
-
SHA1
5f3aa4544127dc58c1be8e59d8fc9c7a5a121785
-
SHA256
c6c6ac8c5d381252b12c59d663a95a3b6c3a13e229c53d2dc637fd76821aabff
-
SHA512
1fdb0f809961b68cef8783a3231a5e2bd7dc7a629323012198d53649db854a28ee49fd6ae88db02e435d4156411d3df79ac4444ce7a1109190c42a149daddfe6
-
SSDEEP
3072:aFufTfrvJc1uVLHdI0dIRlyLuQtA6ZoKY5mFfwXC:a8fTfrvJc1udHd3dISu2A6CKrfo
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.greaterdoha.com - Port:
587 - Username:
[email protected] - Password:
baller01baller01 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6c6ac8c5d381252b12c59d663a95a3b6c3a13e229c53d2dc637fd76821aabff
Files
-
c6c6ac8c5d381252b12c59d663a95a3b6c3a13e229c53d2dc637fd76821aabff.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 242KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ