Behavioral task
behavioral1
Sample
713989084f0940cd45f1d3c1078d2a44eaa3793d0fa5733911a6765b067cb544.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
713989084f0940cd45f1d3c1078d2a44eaa3793d0fa5733911a6765b067cb544.exe
Resource
win10v2004-20240426-en
General
-
Target
713989084f0940cd45f1d3c1078d2a44eaa3793d0fa5733911a6765b067cb544
-
Size
237KB
-
MD5
9d2ea2f8ad7d12c9cde7d1435f2d66c1
-
SHA1
ec8a306170918dec8cce9115c1d13c9987fed3e2
-
SHA256
713989084f0940cd45f1d3c1078d2a44eaa3793d0fa5733911a6765b067cb544
-
SHA512
fde0bbe15913aa3e05759907f744ccc971b17400560f47129246e4b1e1e2ef247a7cc31313368dbfcea49fbc8578db4a5af3adab5be07418cb4e3cabcff74202
-
SSDEEP
3072:IJZcH43mHcAsYcC0aQ3Ul6FVayQaZGdJUyaVR45/Ah908oFN:IJZcH4qcAsYcC0Z3Ul6TZPyyJh93k
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7044826837:AAE9dMlES8PX_QmwrCeRL4sMZZGXHDhzx7E/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 713989084f0940cd45f1d3c1078d2a44eaa3793d0fa5733911a6765b067cb544
Files
-
713989084f0940cd45f1d3c1078d2a44eaa3793d0fa5733911a6765b067cb544.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ