Behavioral task
behavioral1
Sample
2724-11-0x0000000000400000-0x0000000000466000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2724-11-0x0000000000400000-0x0000000000466000-memory.exe
Resource
win10v2004-20231127-en
General
-
Target
2724-11-0x0000000000400000-0x0000000000466000-memory.dmp
-
Size
408KB
-
MD5
0e7d78d22d152492a98803f9a6b0ebce
-
SHA1
3882119fbfddc6de99e0704c5a0206ef77899f9a
-
SHA256
13458873c662d8a502c75e02853428bebabfd59398787fab96e41cdd745a5994
-
SHA512
65c862a9825d5984dbbe8fa005a1cd3c3a24d46d990f01c3fa0c47b69d75c280b62af5d70705d04bd6f9ee89e2a3d2b2f2e51681cd499dae0659874d1dff1c4e
-
SSDEEP
6144:h3sgMoxOrnLC3Gm3DSvZyhZwvAYEiWh1ZV:h3sgMoxOrnLcfmvYZWEiW
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6471053992:AAFUlrUxhi5Jrpjikoc-P4r9ZbsXV_T9vj8/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2724-11-0x0000000000400000-0x0000000000466000-memory.dmp
Files
-
2724-11-0x0000000000400000-0x0000000000466000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 378KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ