Behavioral task
behavioral1
Sample
1872-62-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1872-62-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1872-62-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
45c9fd19bc09d1497bb321ebcfb93c6f
-
SHA1
66f2cf0feea50065a2820d0a130864bf83145719
-
SHA256
201019c80152dd62ee95889e3268dc38bca28915b82873b581a45d3b941aac00
-
SHA512
2d43439f06631078da3bed761df096a862b5c9c6d750c62e1834a22b826fc7a465473e1ed42b78b4152aa38549d654bda6342124e4a8a68bebb1f785326bf645
-
SSDEEP
6144:nZwhPSH7EmsxwwF2G3WONLolKWUS23SIP76J41Y+R6rjUMjeMp:nZwdSH7EzxwwF2G9NU4MIP76Zfje
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tricomcomputacion.com - Port:
587 - Username:
[email protected] - Password:
DANIEL291168 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1872-62-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ