Behavioral task
behavioral1
Sample
6ccc3f3e61fe76c735e88fd7b3537e69fdf8e5df5fa0abc8072c372a7f472702.exe
Resource
win7-20231129-en
General
-
Target
6ccc3f3e61fe76c735e88fd7b3537e69fdf8e5df5fa0abc8072c372a7f472702
-
Size
165KB
-
MD5
2d8bdde94d6e980edddadad55401dd48
-
SHA1
f390ae5f654d7d3e180ad7cfdf7ea80fbc80e17d
-
SHA256
6ccc3f3e61fe76c735e88fd7b3537e69fdf8e5df5fa0abc8072c372a7f472702
-
SHA512
d677b0a1613a4c80b14c59bf6293a91aabb6d9c4774e716a77d5dfc6bb32594afa64fa265584dc3ffb9bc60af1682b4e41fc5e7032a6c9383e0f9e4c6e06dce5
-
SSDEEP
3072:QjzB6wRy9RHx6PHeUeoEp1Ehn8elCAnlheJ7B29tLEfz3f0rkCvlRcIt+RL8:mzM6EdTytlnlsJpsvRVtCL
Malware Config
Extracted
agenttesla
https://discordapp.com/api/webhooks/1068038102737760307/exAoLgGcQ0f3LOHXYxtPkuKzSQzUiqfU5jgR70Ls4QbwPXMFGP6TfGvxetOeNdlj7LcG
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ccc3f3e61fe76c735e88fd7b3537e69fdf8e5df5fa0abc8072c372a7f472702
Files
-
6ccc3f3e61fe76c735e88fd7b3537e69fdf8e5df5fa0abc8072c372a7f472702.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ