Behavioral task
behavioral1
Sample
f8a321e912d74aa9559763e10e0c6a957f42210961383bfe0ea93b81cfdf7a4c.exe
Resource
win7-20231129-en
General
-
Target
f8a321e912d74aa9559763e10e0c6a957f42210961383bfe0ea93b81cfdf7a4c
-
Size
241KB
-
MD5
73e03c58f2658e73f88876ad7d4e4ee6
-
SHA1
c2fd648b24bf2ef7549dbe1adea1b5657a33a544
-
SHA256
f8a321e912d74aa9559763e10e0c6a957f42210961383bfe0ea93b81cfdf7a4c
-
SHA512
392c0b3f1182c97c6f90d1ebace83355820c42d49046bfcf203e65e9d8ce532d31e63450c766b00a3a398e286313f56b0bbd1be718da733f9b7a39922316beb1
-
SSDEEP
3072:/LjVR/+Ayq+rCB2zoXNBTZSbggyu89X2m9:/dRGAX+rCB28PT4RR
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1131831970612121620/odJg89g-Xqfw0EUNSFabJn0Zqa9q-OlbUJFr8XhuKCcB6FOgpSxry05VYNDWwVqflbj3
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8a321e912d74aa9559763e10e0c6a957f42210961383bfe0ea93b81cfdf7a4c
Files
-
f8a321e912d74aa9559763e10e0c6a957f42210961383bfe0ea93b81cfdf7a4c.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ