Behavioral task
behavioral1
Sample
1944-77-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1944-77-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1944-77-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
ee9c558dd0935594ea3b4497c50bad85
-
SHA1
dd59325cf9d9e72ed1691839c96fe203577ec262
-
SHA256
cbb92c5ad26e0961660c3ad1d6baa9741eaa913c6d9019da6da67b3dde260b4f
-
SHA512
0cca5ff8bbe531922b278ded1ca55872dd8691fbf8729c098f57072a1aab01b5e30eefabb27b065abe3900c4d2543729a6bb264b5ea5e8962464fd3e04f7e2cc
-
SSDEEP
3072:8UGIKS+MXh+G/uhyAPfRW5SqmbiUahfPj9H+ITKvbSNHhi4xIzYg5Cska4Aly:zGAtKnRFWUahfPj9eJeVDxIFCfa
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5693260396:AAG301OwiHGjRjWm756cKDUffx0R4fjsv4k/sendDocument
Signatures
-
Agenttesla family
Files
-
1944-77-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ