Behavioral task
behavioral1
Sample
1684922333b300b3d4a7d1c538ee97aa77224661f2b64ecb1d6eae97e79721fbdab6562b1d943.dat-decoded.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1684922333b300b3d4a7d1c538ee97aa77224661f2b64ecb1d6eae97e79721fbdab6562b1d943.dat-decoded.exe
Resource
win10v2004-20230221-en
General
-
Target
1684922333b300b3d4a7d1c538ee97aa77224661f2b64ecb1d6eae97e79721fbdab6562b1d943.dat-decoded.exe
-
Size
160KB
-
MD5
f7508c076620a5ecf01211cc13a62c93
-
SHA1
4c57ff6d90d1a9657e9fa412ac7656ae073f019b
-
SHA256
fe479a6f634d28dcf825bcaa5af048ba4c2c892a1e00d18ef20f63bb35bfb39a
-
SHA512
fdc1d8f592a09b3471de83e34879280feec47c25cc306f4c7a80d5ecab327321a92b64914bb8edbb4d8110d3422fb6704680868e0e84d7d204b13e74ad60a30b
-
SSDEEP
3072:l0xu1fg8xXSPjMIE0LUvnZoEEYIbpdgKJ9fcAZ0H5I4Gm3ER0Z1UdLFGl:lguyPMnmUvnjIvgKJ9fcAZ0H5I4kR01I
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5492937771:AAER0t6JYvhuAZzjUUhpMYIwlzNn8RBwWR8/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1684922333b300b3d4a7d1c538ee97aa77224661f2b64ecb1d6eae97e79721fbdab6562b1d943.dat-decoded.exe
Files
-
1684922333b300b3d4a7d1c538ee97aa77224661f2b64ecb1d6eae97e79721fbdab6562b1d943.dat-decoded.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ