Behavioral task
behavioral1
Sample
1698856265d54efbad1419c6266a9fbc3369c3cc2928bf959ad3a4e2c54278e57ec09d180f680.dat-decoded.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
1698856265d54efbad1419c6266a9fbc3369c3cc2928bf959ad3a4e2c54278e57ec09d180f680.dat-decoded.exe
Resource
win10v2004-20231020-en
General
-
Target
1698856265d54efbad1419c6266a9fbc3369c3cc2928bf959ad3a4e2c54278e57ec09d180f680.dat-decoded.exe
-
Size
242KB
-
MD5
b88212aa343596ae71744b662e0895c3
-
SHA1
22d84653ff8ac51cd462c1ecef68d973b38fbc0a
-
SHA256
d2d1c043548b77e3e0ab6d5f4ac09e7809e11005a73032ad23dbcfa561123dab
-
SHA512
a0746a47daa568ea72eb779e7e650e3c357e043f551fdfc1ba45ea12117a4538f088572bbb2cc3417de0274de3d017e120aa6bbb5e5f37ed99b703d128d2de02
-
SSDEEP
3072:0rT1cv3nffK+cp1ICXeMh1Muwvyvx5sB2BUdVT8:4T1cv3nff9cp1ICDTxO4wcBUz
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6726448718:AAFNb-LBktH8UJpC8JcapANsgwJ2jswG9HU/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1698856265d54efbad1419c6266a9fbc3369c3cc2928bf959ad3a4e2c54278e57ec09d180f680.dat-decoded.exe
Files
-
1698856265d54efbad1419c6266a9fbc3369c3cc2928bf959ad3a4e2c54278e57ec09d180f680.dat-decoded.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ