Behavioral task
behavioral1
Sample
1708-66-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1708-66-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1708-66-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
2af55bd774123aa5750765b974046b87
-
SHA1
099b8d01e2d8392fd56eaa72dc86b42020bb0cf4
-
SHA256
794b05943d32a8bbfcdbcb81740b12b567ef3035a6afef9d2c7b31efceb7b44c
-
SHA512
505706e94efbd836266f483baf1d5ac5cb532c9720589520ce4425ad3ee7e6f28cf0ae3ffa27db7c103b116b2499fa25c337a81f20a0ff51432ead5f8b262d45
-
SSDEEP
6144:vbnrgQFEaHK0+3+oxPUtO6EJAp4lkhap6QPiIDwPaWe:vb8QFEaHsO03L
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5241460963:AAEgY4aglOquc376qhrFLsi4no3j9vYGOv0/
Signatures
-
Agenttesla family
Files
-
1708-66-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ