Behavioral task
behavioral1
Sample
kLGZpCQXfqGCDBi.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
kLGZpCQXfqGCDBi.exe
Resource
win10v2004-20220812-en
General
-
Target
kLGZpCQXfqGCDBi.exe
-
Size
210KB
-
MD5
cded6466e243c80d6db3b1d30a5ecd7c
-
SHA1
13cc93cd06fa3b56554df46e421d8e038e1e1c89
-
SHA256
5ccceb53c4aa4ba94c752be82593545b0df736cc1cb98b6647fc4a7e7f6706b1
-
SHA512
b24b59c7dc995613f40aeea7f25479c8c61e5775faf9db1d783330e5d0af13753aac04fa249a5328e96467deb3ed83251a9f8d6d5a34bfe378fb8ec10c22d84c
-
SSDEEP
3072:TU8IbqHpFa+CjugSLSPbKomuqUeFncj6IH+ITKvbS8hiX2Zen9bV9oahE+:g8f5LSmJUeFnW6IeJe8/Ze5Vya
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1884223853:AAFBJYLvV6hrzs4P4_W7nhkr0P8noC6MWKI/sendDocument
Signatures
-
Agenttesla family
Files
-
kLGZpCQXfqGCDBi.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ