Behavioral task
behavioral1
Sample
1656-64-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1656-64-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1656-64-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
ff135e5335cfa9a266bd5b1f61386c35
-
SHA1
2ce93f82834155e077768bc2e308cd85901e8780
-
SHA256
781c6b65aa989798cfeb15d5d1d549caf6cb2fb05f7f24d3b49242098fbf3e79
-
SHA512
d51509ff8d82ddd462ab6c02070913acf8818de0ef0deff9d42aafda8219f001b5d87bde0d3288b0dd7e038c47c720ac0b4488e8d079f13b90585f8dcc0d87de
-
SSDEEP
6144:My5HfNTEEoHrKs+kPIUoGUEJAp4lkhap67KicprkudSfUYe:MyRNTEEoWn6weGKSM
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5607774642:AAHvNRvZZsOklHgBMuIBbK4hzkG26fMwVX8/
Signatures
-
Agenttesla family
Files
-
1656-64-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ