Behavioral task
behavioral1
Sample
1698127624744697b9e83e99c851607885289e7f49d50aac23f4de1d274f1d2deaca73ec79977.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1698127624744697b9e83e99c851607885289e7f49d50aac23f4de1d274f1d2deaca73ec79977.exe
Resource
win10v2004-20231020-en
General
-
Target
1698127624744697b9e83e99c851607885289e7f49d50aac23f4de1d274f1d2deaca73ec79977.dat-decoded
-
Size
241KB
-
MD5
6bdb7a11d0eaa407e7a7f34d794fb567
-
SHA1
e8a95713d9f4f3d517cc6a7c46145aa436c1ffbe
-
SHA256
5944d934a0233b9c30cfa0b20afe86a09e6afa67030daad7d8c1f0534a9d629e
-
SHA512
5433a3dd0b88b0f76fb51ee4b05ca3c7c803e561f06f36532e8708def7b680780d9b69be9a12daae4d7a78371559decc50086e86f691a2b1ae1df7a627776460
-
SSDEEP
3072:hMz1WOG+mmcw3dz/eb3ooPK26iyJBb5q8oiNjrdC:2z1WOG+mmcwNz/ebopiyLRoi5r
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6663697988:AAHBsfmbPr_JinYR7jDRpZloxUBi6EcQ6HE/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1698127624744697b9e83e99c851607885289e7f49d50aac23f4de1d274f1d2deaca73ec79977.dat-decoded
Files
-
1698127624744697b9e83e99c851607885289e7f49d50aac23f4de1d274f1d2deaca73ec79977.dat-decoded.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ