Behavioral task
behavioral1
Sample
6865a97fdf80736a014eef05467d29f0f19009860e964a07056cf38e10012908.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
6865a97fdf80736a014eef05467d29f0f19009860e964a07056cf38e10012908.exe
Resource
win10v2004-20231127-en
General
-
Target
6865a97fdf80736a014eef05467d29f0f19009860e964a07056cf38e10012908
-
Size
249KB
-
MD5
04e2ad46dd45e2a1427eb7acafce3caf
-
SHA1
db31874eb01e192132457efa76064de524d3128f
-
SHA256
6865a97fdf80736a014eef05467d29f0f19009860e964a07056cf38e10012908
-
SHA512
46468644f7400d4556393f175585aa1ef85b5c0fa33420a31f5bd1886af3581ff4e3c15fa4b93e93b3fe9278151d798face601dcc346fe0a4a3e984153ec8f97
-
SSDEEP
3072:yaGiGa/qaKyfzsZMQzxh97eKo8Pajf1jQGMsK5ASgbR5rUQQ:yaGiGa/qaKyfzsZMe7HovjfhDMsygb3
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6609066655:AAFvSlYuljpA1ReJkQXiHiJh0XH1Axk0H-A/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6865a97fdf80736a014eef05467d29f0f19009860e964a07056cf38e10012908
Files
-
6865a97fdf80736a014eef05467d29f0f19009860e964a07056cf38e10012908.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 246KB - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ