Behavioral task
behavioral1
Sample
1960-71-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1960-71-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1960-71-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
89e048d447252962675327512560179f
-
SHA1
0a429b41fc91987709ddb1ff0b4febff0dfe2205
-
SHA256
d24de98079a0863ec3d09239193abc8b148b13e1288ca46d50d00bea74336a69
-
SHA512
dc35fcce8bf45add77bba4064754348fcbd6a0f233cda23e61232eeaf2835a5edcfd5637cd8258af334d6088b616d36873c40bae543187b1765692f5a7149a2c
-
SSDEEP
6144:tCiaUQFEaHraVm+eQNUhrA+EJAp4lkhap67cZIUpjgIJue:tCKQFEaHUpTIgPJ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5789565839:AAGv9XhsZdqTdFUOTNKJtcYQ1hes323bYNo/
Signatures
-
Agenttesla family
Files
-
1960-71-0x0000000000400000-0x0000000000615000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ