Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20231129-en
General
-
Target
1.exexx
-
Size
312KB
-
MD5
cd36d7aed146aba077ad7800069f4e67
-
SHA1
b4d377653423f01e987c26f77fb38ade9a4313b3
-
SHA256
f1804452a489ce684f53073d0a8ed9fadfb48f684092a1e2df7306f46a31ff66
-
SHA512
1b0153f1cdb27c85840f3f56c69157e811ec9f78793379e8e1d507435fd2de1286c86810b92491151e9df47755dc1dab9ff1c81834a09c0d3e591185834f5ac5
-
SSDEEP
6144:usZuyM7NlNFdSCjx/ZkUs/WDlFQ3TfJK4:usZuyM7NlNFdSCjRZxsWg
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6884112896:AAGytDjPjNEQpizr1di7I3xhWQsaKi4y14U/
Signatures
-
Agenttesla family
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.exexx
Files
-
1.exexx.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 309KB - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ