Behavioral task
behavioral1
Sample
decode_aa158ece3749d5549f3c6680e33b8bc17af98a17ab52c4ccb24f6ee5efad4fa7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
decode_aa158ece3749d5549f3c6680e33b8bc17af98a17ab52c4ccb24f6ee5efad4fa7.exe
Resource
win10v2004-20230915-en
General
-
Target
decode_aa158ece3749d5549f3c6680e33b8bc17af98a17ab52c4ccb24f6ee5efad4fa7.exe
-
Size
241KB
-
MD5
ef31d3507f2d0107c818416a2c8c4ad3
-
SHA1
3a692313771549ca8749b2f04629b39ea86a6beb
-
SHA256
258ba2294b8ea19b823246636fa593aad790a7cd333eeec5510f9b3642937a0e
-
SHA512
081b11292deb0b24e7a0e738d6926feaf36fee903edbc0c561ec57ed97cd3a38f30700046619ba99f6a74767d7cb79dd6bff780cdd5631cf2cfe1e15d5487872
-
SSDEEP
3072:EGZtLz5zFd6FYtuGD/f/zquSorajkYoskZpI2kjF:EGZNxWFYtuGjXzhu72g
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1151093199230750801/wew_Icp6edLoxovewEUSppndNLiamFg25XWBTF6HMXaUUKOrlwmhNg_gIIwSOA5fX-K3
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource decode_aa158ece3749d5549f3c6680e33b8bc17af98a17ab52c4ccb24f6ee5efad4fa7.exe
Files
-
decode_aa158ece3749d5549f3c6680e33b8bc17af98a17ab52c4ccb24f6ee5efad4fa7.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ