Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240226-en
General
-
Target
tmp
-
Size
340KB
-
MD5
845971e68786f9c59ad9e4d5b7a2b1fe
-
SHA1
619a41e8a05c9f1f8aa56684e6578f9efd2acf0f
-
SHA256
e749697baf047ee9b5261865ffb43b8b92e77288f9d764798d00c2fd685ca573
-
SHA512
c00e5cc5bc66c3ef5e078330aa26d5a6c29cd76c611418c3bf16e6f1d25693974757e97cd689c7a587d9a3c4ddecf6c90bd8be7f7015d082987cdc6e1683400b
-
SSDEEP
6144:c8k80ckeOTFIdzXdVufRrLivwburclAp07IdY:c8k80ckeaId65LswburcypJ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7178103238:AAFpcijMmYeMlJJVnAmpmroCaHuSs5YlbxU/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource tmp
Files
-
tmp.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 338KB - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ