Behavioral task
behavioral1
Sample
6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c.exe
Resource
win10v2004-20230220-en
General
-
Target
6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c.exe
-
Size
169KB
-
MD5
2daef28d475a4a352d9fc7ac0e9c95d8
-
SHA1
65e929a362abc23a3ab53198302fbd2c99a611fc
-
SHA256
6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c
-
SHA512
9c2870c49144ffabc521acf8a50ff00a1d1771385acf546193d7eb93c5be008e603e34c35775d21cae2d4049fbf4b5c7b40560bffea20caab1b9dd2ea4d170f6
-
SSDEEP
3072:9RxNAI/XqL9t5EztUNkoLXgkBycVHOdBdGBDHijFw3TiC8sv8:9RxOIPqL9t5EJpoDzyc4BdGBriUTiC/
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6111714079:AAFzzMdup6ZnmMRcX47JfRoV9xljqXoxRL0/
Signatures
-
Agenttesla family
Files
-
6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ