Behavioral task
behavioral1
Sample
0x0008000000012028-1385.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0x0008000000012028-1385.exe
Resource
win10v2004-20230703-en
General
-
Target
0x0008000000012028-1385.dat
-
Size
218KB
-
MD5
6540419700023532067d0c46ed61bf10
-
SHA1
6a2bf87eba3c5d884176e5614760380ee6fff0b3
-
SHA256
b99f5a57a5a32d2fe5945cfe309e847dfe75568f0544efef2498def66c895326
-
SHA512
fb3206f2414de8699c888bd84107b1d020d1eeb1f41303b1f12649049633ec115a90a870f5805b2819befc14cc71725e3dae1aab18cec68bb1200a66812c7782
-
SSDEEP
3072:02hCAdhGZBMLyRoKeNTwDagUiqdLnKEXzE7mxsGB8J/kSnp0V5SCHRTTTG2nJ21p:KAaoKtxUfKEwwGGSn2qGVTTG2Jn8EU
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5127674234:AAHGscjRk7JCDDCItFO4GPZfan-K7Hc89Z8/sendDocument
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0008000000012028-1385.dat
Files
-
0x0008000000012028-1385.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ