Behavioral task
behavioral1
Sample
e6761c7ca856c8eba95b17130115fa6a865d37801277b949256b886b8f13ec87.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e6761c7ca856c8eba95b17130115fa6a865d37801277b949256b886b8f13ec87.exe
Resource
win10v2004-20240426-en
General
-
Target
e6761c7ca856c8eba95b17130115fa6a865d37801277b949256b886b8f13ec87
-
Size
218KB
-
MD5
ab8b1948f3ae5c9c73421bdd8b578586
-
SHA1
11fd5d92fe42a30aac22e79e2597c303654ef02e
-
SHA256
e6761c7ca856c8eba95b17130115fa6a865d37801277b949256b886b8f13ec87
-
SHA512
5a295fa5d3847e7b586bfc5798068b6355f4feec78571754a8adde473d258d23275a5e5d7999c8ec3e531d3ab0ffac0d521718055ecc821c2499aef0f4671e93
-
SSDEEP
6144:B5HxsCG+UfSU99ExBMeakF50P+W3E3mrutNOS:zx3UfHduCP+WWmrzS
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5018340186:AAFKw8ktzY7O_6e1fhgEWq27H2aE-rsBGjA/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6761c7ca856c8eba95b17130115fa6a865d37801277b949256b886b8f13ec87
Files
-
e6761c7ca856c8eba95b17130115fa6a865d37801277b949256b886b8f13ec87.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ