Behavioral task
behavioral1
Sample
788-66-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
788-66-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
788-66-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
595c29b27d8cb53bad5f38bdcbb316a3
-
SHA1
49b27fd7930d3f33390d47d523587f3908028b0b
-
SHA256
57ff3c21248f5372b8df02f49ca44335cd40b951df9e32123ae43a508f58d1b4
-
SHA512
1f80409468d410658a5a5af6bbdd10b958ac663a2db77a252d0ac45415a1283dfe4312ea5cfe842b1026456538c9958a9b4e4d7b2c9ecd22700bdad9dcd7146b
-
SSDEEP
6144:9/8U99CKiY6LAXU5H4xBMegxF5+nhIXmLfrFK/:d8U9vivLAOFbu+6c/
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5642205413:AAEVTUG9BJlGqe2WGFdx0ocZKR20YKKT3q8/
Signatures
-
Agenttesla family
Files
-
788-66-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ