Behavioral task
behavioral1
Sample
460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8.exe
Resource
win10v2004-20230220-en
General
-
Target
460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8.exe
-
Size
164KB
-
MD5
ef86dc729baa0495a965624481e6f1a7
-
SHA1
f9e3084c3621a73dd93b40bd25d27ab5ce88d998
-
SHA256
460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8
-
SHA512
51437a7b50ca4c9702ce029d4d8b5e844a12d069352dfcc1a7ba20f391cac171f004805cce176fb4ac9691d703f80d663d0e373096e57514df06d896e5416993
-
SSDEEP
3072:iTH3dA00skXOu8hwHIdT1/Lz17iVW7hpwPMsem:iTH3dA00h8hwH0h1qM
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6033005603:AAFnN3UWkxnurt9KjO1qxD4NTlJRB3IwKuk/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8.exe
Files
-
460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ