Behavioral task
behavioral1
Sample
1436-66-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1436-66-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1436-66-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
1be71af6eb606240d0974ffdbe440f19
-
SHA1
b41b37ca64d49ea4b5e201350d61a424547f7b97
-
SHA256
4bfce47a614257df04d06b14b569f64a340757c53a2c193ceacd896e0bb5be9f
-
SHA512
79bb2c4d2abd41b48c799b5e3d8042150d82f87e82dd02bf2d70e7f63bee7d198ec47535a10d40f82bf6a92a8638fb0a631d70f3e9ea854fd8fc6a1dbefc5e26
-
SSDEEP
6144:fHMvcP1gQDY1d3m6nM5z9U5TJXJ8QSFZd/gZbzjCRR2YSDzFc:fHMvI1nDYPpnGz+FXHSFZdqXH
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
application/x-www-form-urlencoded - Password:
[email protected] - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1436-66-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ