Behavioral task
behavioral1
Sample
584-64-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
584-64-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
584-64-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
676898d87a71372209df29a1f42d0571
-
SHA1
fa6931c6b1814fef076cbc53430ee42e22ea9cdc
-
SHA256
409b1f72696da488ef9bac342b60deff914b11184f3fd1287dd930a202a7ae35
-
SHA512
a992d6cc8096344d6714f6a574762ed06c8585779bcf112315d6cc9af86454e365189ad378b27048ab18db77a9c83d30f1912eb3f569a6f43c8cf12584f31d67
-
SSDEEP
3072:nrsEsZQWZIvN24P3GXuEIeo2J9WnbGB0okAAEU8A6Ivsa2fSZaKLEaT6Sys4A:nrsEsZ1F9WbGB0sTU8A6IeKZr/x4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.suyogholidays.in - Port:
587 - Username:
[email protected] - Password:
shilpa32
Signatures
-
Agenttesla family
Files
-
584-64-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ