Behavioral task
behavioral1
Sample
fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04.exe
Resource
win10v2004-20230220-en
General
-
Target
fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04
-
Size
214KB
-
MD5
1e302f38d0015490410265839870145a
-
SHA1
d87da41895d82b0254df1b42135df2a71a3a4645
-
SHA256
fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04
-
SHA512
8bfcbddec52cd6c7be21e0b743cd9b96b9bfae561db13bb90c7a6619bc858c9f1f69183c75a07474b32b2773e692f757a189dba3f881f225426ddf468b399e2e
-
SSDEEP
3072:HbstfsajUzAqkrLAxRUXuiUiKTutdR9AT6GDAvPJfALZR05FP/xdu6C9bwtWtHZ:kPjqkrsxqTUdu4AXJscTcBUWt
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1360033246:AAF6H8m6YrL09doyxtsvJzZ_cIl__BCF4aU/sendDocument
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
Files
-
fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ