Behavioral task
behavioral1
Sample
888-62-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
888-62-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
888-62-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
b1b0249e77adca07715bee6eb555b8e4
-
SHA1
370274cd1e134decb87ba45a6f4aff3157f9d3fc
-
SHA256
1377c0145a374f3f7d6600d8b9a0bf08bbcf1676c982933f55e48b73e2abc4cf
-
SHA512
923b6dbc15984b6c6b49cadaa9805cd0353a0f171aeb549484595748417741d2878ca247d10600b48c9d57833a853b5d4178b0146175411d7fa85d47fa8525c7
-
SSDEEP
6144:VFolI1Yxx/YEoR6IP+Rc1UnKZEJAp4lkhap6nJPiIDKnhe:VFoVxx/YEoLWWzmn
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5357159221:AAEuOoQ0pUc4ccIZou0EJ5Zin0mMneE2jYg/
Signatures
-
Agenttesla family
Files
-
888-62-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ