Behavioral task
behavioral1
Sample
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.exe
Resource
win10v2004-20230220-en
General
-
Target
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.zip
-
Size
82KB
-
MD5
69d2da79e9218b4c811ee363df4a96f3
-
SHA1
356ccdec45ab9a8644603d4dd601e9cbecaa4060
-
SHA256
53c4fa85d92e6c018e29495953ce94a59b07c2c11a229fdf2c20736b48d3f1d4
-
SHA512
0e8eaeb652c97f9f6c1b9625db98e9122cc75d0425931daca62964edd7ab7541723a9c79e3a249bf1470e2cdb26ec82c84056fd0cb629b08a3607faaea3d1aaa
-
SSDEEP
1536:6kTDPY+QjYJM526XnQqG1WqPTR/B3BbIoVlyYzza0ClhAofwF/ndaAoC:TTDFQjSG263BGFPN/B9zlyYz+TPzfo7
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5350270151:AAHiqzi7CQnEGEk3Xi-PyJX8ov0x6B-8S1I/
Signatures
-
Agenttesla family
Files
-
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.zip.zip
Password: infected
-
a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ