Behavioral task
behavioral1
Sample
f28596a22b369c545afc0e7429b25e76b058dd2c52227d0e3bbe6137259778df.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
f28596a22b369c545afc0e7429b25e76b058dd2c52227d0e3bbe6137259778df.exe
Resource
win10v2004-20240802-en
General
-
Target
f28596a22b369c545afc0e7429b25e76b058dd2c52227d0e3bbe6137259778df
-
Size
244KB
-
MD5
61ac354efe49a07212d2d438e9ff3f21
-
SHA1
10e53c19871633d7012f3b5e0fde072ed0207fb1
-
SHA256
f28596a22b369c545afc0e7429b25e76b058dd2c52227d0e3bbe6137259778df
-
SHA512
6920f2821519d5be1b0beb5f7043f05268a193fc4401e15f050167472940c46515158f9b74be469806d2105f0e7cc84d5c89025fd776e5134bc737f41f232b96
-
SSDEEP
3072:0E9GPoG1F91NltoTGY7a4bczoIX7WTGGOU5Um5M9GCQ:0UGPoKF91NltorgoLKFy5Mw
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7220431026:AAHszs0XzPcajloTXlLJDVKab99uNUvPaok/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f28596a22b369c545afc0e7429b25e76b058dd2c52227d0e3bbe6137259778df
Files
-
f28596a22b369c545afc0e7429b25e76b058dd2c52227d0e3bbe6137259778df.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ