Behavioral task
behavioral1
Sample
384b4910d59d1f31df75d6232d7a1e8cc91a9ce29c68ffcefd26b52a372386f7.exe
Resource
win7-20240508-en
General
-
Target
384b4910d59d1f31df75d6232d7a1e8cc91a9ce29c68ffcefd26b52a372386f7
-
Size
168KB
-
MD5
51590e6a0ff1cdbc7e24fb6e1831ceba
-
SHA1
79ae57efbdb83379242d5093ae3a0882ef2aef88
-
SHA256
384b4910d59d1f31df75d6232d7a1e8cc91a9ce29c68ffcefd26b52a372386f7
-
SHA512
622c9b2f12f7bc1f5eab477910e1399ac2ed54fa2ac77a4e7db103e984016fc9a384dfeb717aaeedbeb5f58c431155b5fb8ef65e86eed6bc07a08f1d9e8a2409
-
SSDEEP
3072:cfkLJLahKd0DjzOAuE2YJx+SWBP7G0k3ORdSUCntPwZb7OtlUn:vL00d0DjzOjEFQJ5dSUwOZbiH
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5826219676:AAHzaO_KidyTjZ5PTwFErYpZivpT8wfDUno/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 384b4910d59d1f31df75d6232d7a1e8cc91a9ce29c68ffcefd26b52a372386f7
Files
-
384b4910d59d1f31df75d6232d7a1e8cc91a9ce29c68ffcefd26b52a372386f7.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ