Behavioral task
behavioral1
Sample
2132-4-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2132-4-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2132-4-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
2eecd2839ebdd69bc3345396165bc057
-
SHA1
288fef0d70aeb84fbb369d8a4b6ec160453867db
-
SHA256
abc532494cfbeb09ab0a364f9d91a46b49530bcf2b77ecce0121fb9ea3d3de0a
-
SHA512
27d1b1f0d54fd0b22088c08577b14dba017592a75a24fa72447599b074ec9427fbde01037f59231125ca3a30754930caddd2691c151bcddf478751e07b8f4b55
-
SSDEEP
3072:wtFlEtiPXsLXY5CW+EO1d/Yy6+O31eQNR:wtF2t0XsjYAEoQHnN
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6460260286:AAHzJBvTVd5L_-gUrGtb1NVevQQtExU9kas/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2132-4-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2132-4-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ