Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp
-
Size
246KB
-
MD5
00cdf04e6c1e56772e0181de92a6beb8
-
SHA1
d7466d629062c492e918d33b031e1cefdf715d49
-
SHA256
045e8b4f5d4e24a8e6e4f4571a7e1b45d00ffda46f3e33c6551bf10b059beed0
-
SHA512
1bfe3f2f1e38c58327b7d485783f365eb8931c8cc754025c6b65df3907ecf516baf465d89f09610532389c4f9cfc8e4d2f20e23b149217f8ebe6f2aa7405609d
-
SSDEEP
3072:ff+VPdDxYsnYQdJxJvTvgE9w7gVRh40XGDNA37:ffWPdtfYQdJxJrvgHUe02DW
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6515773992:AAGxfvtfi52THqf0poVikQjud-DY6wxSlIw/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ