Behavioral task
behavioral1
Sample
3df64c5fda8e19fbdc3e7701b58cf5591c7429af64760dcaf1c4afe5e2785ce4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3df64c5fda8e19fbdc3e7701b58cf5591c7429af64760dcaf1c4afe5e2785ce4.exe
Resource
win10v2004-20231215-en
General
-
Target
3df64c5fda8e19fbdc3e7701b58cf5591c7429af64760dcaf1c4afe5e2785ce4
-
Size
238KB
-
MD5
e9af1cf2efff7e1298a6e6d188fe9042
-
SHA1
eb32a224ad3c9bacca3ef87b7379a7634bd23705
-
SHA256
3df64c5fda8e19fbdc3e7701b58cf5591c7429af64760dcaf1c4afe5e2785ce4
-
SHA512
f1c4e4a9ea00e07f7007eefe0255d2d567dd22cc5ad07ea00df43a9ae9c73b8c85969b055453638973b3b63c90c905ea9f18704e6ec9b8e44acaae5f0bd0843a
-
SSDEEP
3072:vLceO+eOBQ5g41peil0WhICwJAc68EVJT5BOLXX589Brk:vLceO+eOBQ5g41ptlXhwJWVJTMXXS
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1173532822850510939/7ycdzOYZS7NjzueOY_4g9vijhjznK0lj8yLG7yS-AXhgkar7Yob44mkj1VTzCjoxasQO
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3df64c5fda8e19fbdc3e7701b58cf5591c7429af64760dcaf1c4afe5e2785ce4
Files
-
3df64c5fda8e19fbdc3e7701b58cf5591c7429af64760dcaf1c4afe5e2785ce4.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ