Behavioral task
behavioral1
Sample
888-61-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
888-61-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
888-61-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
544de5b2d3c0f97224b1fdd8038f26a2
-
SHA1
10c6291ff1231fa67b7b08fd1f33abc2e3e8ee03
-
SHA256
cbb80b009d129d7027ba2bc6770f792f9696b20e9f92a6a737d21d792248dace
-
SHA512
4d050114267e88df0ab0cae6b7fba3a68f3709103e0b595e04c7f409817c7152f9c9df3537d3d2fcdab0a39d41facd1c0373168fde57b66e3fe00d7ef0437b16
-
SSDEEP
6144:g1dhYQm9xxm4/tYtUlaVYR01MdIxsHU/exI2bQXeNnje:g1oQm9xxDebSQONn
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.lansol.com - Port:
21 - Username:
[email protected] - Password:
@t6cIop2jJgW
Signatures
-
Agenttesla family
Files
-
888-61-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ