Behavioral task
behavioral1
Sample
c3f08f52fb533c480af1c25b6a2394805e25ab3e7cf9b72872a0bfb836dca02e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c3f08f52fb533c480af1c25b6a2394805e25ab3e7cf9b72872a0bfb836dca02e.exe
Resource
win10v2004-20240611-en
General
-
Target
c3f08f52fb533c480af1c25b6a2394805e25ab3e7cf9b72872a0bfb836dca02e
-
Size
224KB
-
MD5
1d28f653deda2a9bf557b6c0289fed5e
-
SHA1
4af70c5f5dacf204819be6b6c1b8c633c0428276
-
SHA256
c3f08f52fb533c480af1c25b6a2394805e25ab3e7cf9b72872a0bfb836dca02e
-
SHA512
24ef5e875c00e0d41f3398f357b2606d3907bdea3880add2202ae3437a780a526676a6ac1082172d6d5bb94337812ed6bf30fb3ec9aa64767924e18ce2d21844
-
SSDEEP
6144:q4FMLJAY0n33chw2YeX7riyB317/vfcI2zM:qjFAY0nchworria39MI2
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
=A+N^@~c]~#I
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3f08f52fb533c480af1c25b6a2394805e25ab3e7cf9b72872a0bfb836dca02e
Files
-
c3f08f52fb533c480af1c25b6a2394805e25ab3e7cf9b72872a0bfb836dca02e.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ