Behavioral task
behavioral1
Sample
4404-133-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4404-133-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4404-133-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
65dd0f6f291336c4e776ff3854cdc624
-
SHA1
489bbcd20a465d40eb3017da6258e440b28e071e
-
SHA256
f0993b9bc7d377c3cfd92116d725d1d556a5511fcf964c51d281d3c7b0c597dd
-
SHA512
4edc0e759ace3e89104fcc312a5529900529c4558f3a99a3db477b985647f4ab9649b41875a74daa664318bf564cc95bf845f520274d06638202a3ee22ebda74
-
SSDEEP
6144:7GAYNAxsFz5OuS8SsaRGpBrUL+vyHuTuTOVChGunoE8ZTwCjSX:7GAYNVa0ZBj
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
%2B - Port:
21 - Username:
application/x-www-form-urlencoded - Password:
image/jpg
p=
Signatures
-
Agenttesla family
Files
-
4404-133-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ