Behavioral task
behavioral1
Sample
1780-67-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1780-67-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1780-67-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
64fed43716cf88d6f7ae08b57465b068
-
SHA1
aaad25c603c426f1d2d5b7c06d4c6aa9b63b13e9
-
SHA256
5d1b53a175b93f685520fa02a5cb7c753ff8caf1ffd6dbe1b2c12e132b6857b1
-
SHA512
7be3b368e95f61a8eced6e02c90d3e9045f0383fcc559f2e439a17b5340658b1f04ef3ebae243b07331460b89b7d9e1a735e6ff0b842bd309879e2c7ae7deb45
-
SSDEEP
6144:TwnkThmYlyguDV7+QFUYOGEJAp4lkhap6qTZIUEDe:TwghmYlyPKQD
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5544798312:AAFCE9wlKN3YHM9MGYnKgWUb8D_lz2PBmQ8/
Signatures
-
Agenttesla family
Files
-
1780-67-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ