Behavioral task
behavioral1
Sample
458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d.exe
Resource
win10v2004-20230220-en
General
-
Target
458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d.zip
-
Size
83KB
-
MD5
7225bacaa3ce90ece5ed33d762bb4e9c
-
SHA1
54cea86c45515c7feb654fe8334e4953e7e813a3
-
SHA256
2ac04c4713b6d2856533a3988f1af0a5b1722c440c86d6347c827be959f8d057
-
SHA512
87182bd2e87e48f8f1e3e22dadf184bea2158f3628b71b830624c42294fc189148252b9010da914fc7e9ed53b493c4a4e055c495da810ca6012e46b5f0b6987f
-
SSDEEP
1536:m2o75WLNrTK/AlEzo4OMYXJmFkR6WtLe0TqXuCn3g/c7TipPIAIX/HJb:WGTXr42kjFw/c7myf1
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6192832133:AAF7C5Hu2cAny_oozlOAGw_7DWfvYVumEbE/
Signatures
-
Agenttesla family
Files
-
458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d.zip.zip
Password: infected
-
458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ