Behavioral task
behavioral1
Sample
eabacd19d31a3f06a9d83aa3dd8ccad71fa7c0addf6914da7ebf7e641d69e973.exe
Resource
win7-20240221-en
General
-
Target
eabacd19d31a3f06a9d83aa3dd8ccad71fa7c0addf6914da7ebf7e641d69e973
-
Size
165KB
-
MD5
697a5c7b9a305868885d3cecc9f05a98
-
SHA1
cb43671a153ce82f243c5bf3b74f6fd45052e75b
-
SHA256
eabacd19d31a3f06a9d83aa3dd8ccad71fa7c0addf6914da7ebf7e641d69e973
-
SHA512
eb81e6378f0d95efe99e9bd74d0afcadc953f85aaa4099478ec3f8aed3f8bd4cf5c4c53628b55c7414084ff697deabb533f2024e544a43c70cf04ca2f3d9cc0b
-
SSDEEP
3072:R4iMeZJuNcHBqw651cxVtTssyskqCEkeTBEUCNkXpnHh9W:R4iM7eBfQcxVJUy7BXXpB
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5998942230:AAFdNraKyf9jiD3__pmissoEtTEBOrjcXvc/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eabacd19d31a3f06a9d83aa3dd8ccad71fa7c0addf6914da7ebf7e641d69e973
Files
-
eabacd19d31a3f06a9d83aa3dd8ccad71fa7c0addf6914da7ebf7e641d69e973.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ