Behavioral task
behavioral1
Sample
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.exe
Resource
win10v2004-20230220-en
General
-
Target
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f
-
Size
164KB
-
MD5
a61c784f54aa2de0609b8dd99c5160a1
-
SHA1
5cd9d12d72c566bccfabeb130fe67b121dc40479
-
SHA256
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f
-
SHA512
a0c50d32b1e645153203038abc668530b66b0d9baf8e03dba8dd1351ee83760ee9391a573b8c127fca5f1f0f8e32b79d104648dff2ec79aed83c74456f0e3880
-
SSDEEP
3072:wRBoYX8vD0ibr1D5bJm+p3+mR4JoSwVp0+rHx7t7PM30nz9cpA:wRBe02h1bs+pOm6Wl1Xhz9
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5350270151:AAHiqzi7CQnEGEk3Xi-PyJX8ov0x6B-8S1I/
Signatures
-
Agenttesla family
Files
-
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ