Behavioral task
behavioral1
Sample
17ff686ff85d703ea8bec76165d02605bfa0b3a373bc2cf77e08a1946c471362.exe
Resource
win7-20240508-en
General
-
Target
17ff686ff85d703ea8bec76165d02605bfa0b3a373bc2cf77e08a1946c471362
-
Size
165KB
-
MD5
d2228d1c17337adf65cccce1cf4c7bfe
-
SHA1
4ccba2fa73425b9ef0a7331324e86dafce9e78ec
-
SHA256
17ff686ff85d703ea8bec76165d02605bfa0b3a373bc2cf77e08a1946c471362
-
SHA512
4d7ba6d8d434b16089c3dd921aa95a97a8fc178acdad73de3068d2f5200849679974a53f1c254ac569f5de2201a5a467fb4c60460c730bfbad05ba0f5818a1bc
-
SSDEEP
3072:YRXNvqs28Vl9VkKtFHQS6eIlRkvxExEiJmS0F5MC0CjGbo:YRXNvqs28Vl71HQSY6+tuF3j
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6260905292:AAHE4OM1dzCRC_GiIRXHks1lImrdUB7iroI/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17ff686ff85d703ea8bec76165d02605bfa0b3a373bc2cf77e08a1946c471362
Files
-
17ff686ff85d703ea8bec76165d02605bfa0b3a373bc2cf77e08a1946c471362.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ