Behavioral task
behavioral1
Sample
840-64-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
840-64-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
840-64-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
173568707560ad28700a5ac4549a0b44
-
SHA1
7128dab6b264f2c0fb35ac4102f03a9e7f982fe7
-
SHA256
ca1aa72064b00d21d4724aae8dc6a31758a7e7cc85692f42abff5d4f54b46651
-
SHA512
6a833a9177c786066a12b6720a8ad0fa6c896e5c819ace5c5923d31c107c89365ed7143cf9f4c5f8a9a6fbef031bd494da5ae60183cfd2f025485b1e55351f36
-
SSDEEP
6144:7YvvrL0TEMLh321zn+QI9UPqEJAp4lkhap6aLyIoMnaWU5qEIe:7YvX0TEMLho+JmZUAE
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5487262913:AAG9VkuhhZ4opsxigA3AmO8YuHzyyPC9-Go/
Signatures
-
Agenttesla family
Files
-
840-64-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ