Behavioral task
behavioral1
Sample
3292-140-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3292-140-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
3292-140-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
3a4bad1d1a4c844b8fce9b53611b0987
-
SHA1
cd587b872c39e5019c0f8c144812ef5ae132e328
-
SHA256
1a4f37fc44a3c75176f3a109d8ea3b074adc73fedf7ea403e5610beb87868b83
-
SHA512
8a9364f61485d16710f2fe359d404c4ac697a7949b15e25a3be729f513b9efe02cab58192521aa50800f95bc97fbf5bf08f520c5a9113b140d03e08e759833a8
-
SSDEEP
6144:tGRPiwS/YMpfjyz+0kvUlDEJAp4lkhap6n++jbQ+F/yLe:tGR9S/YMpuylh
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5662683474:AAFvSjyPXTiwhBPcFi8of3_-_FCdfhhN8x0/
Signatures
-
Agenttesla family
Files
-
3292-140-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ