Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
209KB
-
MD5
f1d626b6a45cd2489e13c329f61466f6
-
SHA1
0630604c4c1bac79c4d736ddbf10571b0926e2a0
-
SHA256
6e79cc584d22059ea38f8c3c619eafaa22e8ece37d3c04839e47fe2dcfd4a15f
-
SHA512
df6139445027f01491e1fe7f1dac4692a1013d75f0b6a81fde9110e6ba44c267b196921350c08782fd870757f6442ad887b741bfec6fb8e7f5a8cff197c7ebbf
-
SSDEEP
6144:lXlCTCzG6+egje1MCiG1yFUX4GPCXy7eL2j4XsgaIeDjrBaO5kEHf:lXlCaPih2CE
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5019561683:AAH9NSGflF0D1BZLV24UCg2U00UsAk_pP7g/
Signatures
-
Agenttesla family
Files
-
file.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ