Behavioral task
behavioral1
Sample
0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857.exe
Resource
win10v2004-20241007-en
General
-
Target
0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857
-
Size
2.6MB
-
MD5
db6e7ad1989bed2c0762e3764f7d92c6
-
SHA1
c22134db04f0eac36bddd0bbad64173603fa2c69
-
SHA256
0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857
-
SHA512
b2da98b205bb8abbe81366f134b8ef501968f7b2464717552bbb2ed50b73ee489c4ebb08d8b1afff60226e01afe463797446f197b8eaba2940ad53fdbd455d09
-
SSDEEP
24576:qbMErVlmEkT+Zn389PbvY/0f/0lqkjc4JhUj0Vl/NvQMvaiDKU:qIExlmsn3819GqkorjYGMvaiDK
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mslofa.com - Port:
587 - Username:
[email protected] - Password:
fzLaYaZ8
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857
Files
-
0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 298KB - Virtual size: 297KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ