Behavioral task
behavioral1
Sample
0f5732b1320632b53b8adc5cabf2eacac25363602b45711f2c07b5fed0c4b4e1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f5732b1320632b53b8adc5cabf2eacac25363602b45711f2c07b5fed0c4b4e1.exe
Resource
win10v2004-20240426-en
General
-
Target
0f5732b1320632b53b8adc5cabf2eacac25363602b45711f2c07b5fed0c4b4e1
-
Size
165KB
-
MD5
7f960a25874860e3cb2f6d1065380dbe
-
SHA1
88ba2696cea24a9181d603aa0fcdb624fc56500a
-
SHA256
0f5732b1320632b53b8adc5cabf2eacac25363602b45711f2c07b5fed0c4b4e1
-
SHA512
a9629b05f67c039f6037d5b2640be069c3c8d4265a8bf91105cbe853edcadb0e3883f89b02119ea4a905b0340e149a183aaac5b714a1b4243e7fa076b4d2f22f
-
SSDEEP
3072:d7vXpUuAA58+YO7FAJfSLuuvRExAY6gFSDuEFQHDlbVugXB:d7vXpUuAWYO7FWDTxA8FSxFQHxU
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6048733251:AAHRY3bwFxY_dCpUKVaxkoIu25MIjLFtqRA/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0f5732b1320632b53b8adc5cabf2eacac25363602b45711f2c07b5fed0c4b4e1
Files
-
0f5732b1320632b53b8adc5cabf2eacac25363602b45711f2c07b5fed0c4b4e1.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ