Behavioral task
behavioral1
Sample
907f37090aaf8b353c85ec37240a1d3390c72feb24390a8e0dae44b3b740dd3b.exe
Resource
win7-20240221-en
General
-
Target
907f37090aaf8b353c85ec37240a1d3390c72feb24390a8e0dae44b3b740dd3b
-
Size
165KB
-
MD5
2ceaa669f0fa3726737c12994eaae9ee
-
SHA1
0e2f00e2d73cd07609989fbaa01f06a4aed907a0
-
SHA256
907f37090aaf8b353c85ec37240a1d3390c72feb24390a8e0dae44b3b740dd3b
-
SHA512
c53922444b056106967cd1a92e1664bf212936d1c6d634151549b458039630db35861324429960bb5a6bf7b64011b57d9cac5d781efa6ac988228356877be03c
-
SSDEEP
3072:SdFv22Qm14u+Hn9PG11wmS/wPtEZxgm3rLuvhif:7S+H9Q1ywPyfrLu5i
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6027764955:AAHvraynEOD9uXKNgo91qks8y3Ukt_3EA_s/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 907f37090aaf8b353c85ec37240a1d3390c72feb24390a8e0dae44b3b740dd3b
Files
-
907f37090aaf8b353c85ec37240a1d3390c72feb24390a8e0dae44b3b740dd3b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ