Behavioral task
behavioral1
Sample
adcc1b9806fa2218b3898c8079412b47519be0e02d3b995207446f43d3ae56fc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adcc1b9806fa2218b3898c8079412b47519be0e02d3b995207446f43d3ae56fc.exe
Resource
win10v2004-20240419-en
General
-
Target
adcc1b9806fa2218b3898c8079412b47519be0e02d3b995207446f43d3ae56fc
-
Size
240KB
-
MD5
1dc81c50cfdcaf4d257dd5bdf6cd87b3
-
SHA1
d9524b3af7ffcd33897b0af5471b9d2c133e2adf
-
SHA256
adcc1b9806fa2218b3898c8079412b47519be0e02d3b995207446f43d3ae56fc
-
SHA512
79e644b3ae80b45c00b80068653b0633db419e3c491057b38fdb5c54c731b32e955b080cb052257900e35771796bf55521a9b13d26ffb51d761a2c4da3d00c96
-
SSDEEP
3072:jLNJXb3ux8iOPMS3aUJlTzt+ZblMPSikdVNlXf53/57uD8i/NmdF+0:jLNJXb3uxwPMSydfpf9l68w4
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6753278263:AAFxt8K5Mgiu95-IRj9GzpDlMcnYEwqlk6c/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adcc1b9806fa2218b3898c8079412b47519be0e02d3b995207446f43d3ae56fc
Files
-
adcc1b9806fa2218b3898c8079412b47519be0e02d3b995207446f43d3ae56fc.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ