Behavioral task
behavioral1
Sample
3710edf9da75f10611499c61ae7bfa193a937f444321987db135f4a18103fa6a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3710edf9da75f10611499c61ae7bfa193a937f444321987db135f4a18103fa6a.exe
Resource
win10v2004-20231215-en
General
-
Target
3710edf9da75f10611499c61ae7bfa193a937f444321987db135f4a18103fa6a
-
Size
242KB
-
MD5
0a823891726a62014db8591eb4d091a8
-
SHA1
7eb5e55aadc94950fe7717698a41d4a6ad075b3f
-
SHA256
3710edf9da75f10611499c61ae7bfa193a937f444321987db135f4a18103fa6a
-
SHA512
b63fc7f463cc4e9d7f0e34d7599e50ec8f881546d519af22bfea4621a7a169335314a4293f670b7f2791f573cfe4f754001ff467128a1d49d482614f6264d10b
-
SSDEEP
3072:GHceO+eORQ5gcRpeilUKhICwJAg685VJT5BOLXX589BrkBM:GHceO+eORQ5gcRptljhwJXVJTMXXS4M
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1173532822850510939/7ycdzOYZS7NjzueOY_4g9vijhjznK0lj8yLG7yS-AXhgkar7Yob44mkj1VTzCjoxasQO
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3710edf9da75f10611499c61ae7bfa193a937f444321987db135f4a18103fa6a
Files
-
3710edf9da75f10611499c61ae7bfa193a937f444321987db135f4a18103fa6a.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ