Behavioral task
behavioral1
Sample
914d720b66d53810629e010493e8b810bc0176808c7fe8b169778bc7e46ee501.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
914d720b66d53810629e010493e8b810bc0176808c7fe8b169778bc7e46ee501.exe
Resource
win10v2004-20240611-en
General
-
Target
914d720b66d53810629e010493e8b810bc0176808c7fe8b169778bc7e46ee501
-
Size
244KB
-
MD5
a81a8d0daa3f53bdaeb3266dc3357476
-
SHA1
23d61c5ba4fc0c9cd75e1e8a77053d59327516c4
-
SHA256
914d720b66d53810629e010493e8b810bc0176808c7fe8b169778bc7e46ee501
-
SHA512
bafff44484c635ef3a3f9822d9f5b83052af1bf52ca1b2ee0c2dc625fd69ddf0b3fe6e0340aa5a8e11ac6c010482b67b29351c0b6836e9267c501cef1c1cb253
-
SSDEEP
3072:ZBGPDztlNV98ibhMEFx27S2lyy5sUqI052utfq1Zdo:ZBGPftlNV98imQq11Ytfqn
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7369793648:AAEVAcSH3HhrNWPSPetVU1pS3jXGL72HQzY/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 914d720b66d53810629e010493e8b810bc0176808c7fe8b169778bc7e46ee501
Files
-
914d720b66d53810629e010493e8b810bc0176808c7fe8b169778bc7e46ee501.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ