Behavioral task
behavioral1
Sample
3604-138-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3604-138-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3604-138-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
7463220553981d6bf7f311a3aa113d8a
-
SHA1
9ab9f0ff695fe772353e56709938e24944c6dcf5
-
SHA256
d0dc1e0347bb53c2b2dac34404bf1d2914eb6d4dcdc2a07f417f67fbe9738cf7
-
SHA512
11ed28847e464cb68cdd527f37452f63f6261cedcb2992c021a5aa25708f23cb2ee0dd2d9d8187481f1bf14b84616e90b20b407101da049bdb13544368ce68c8
-
SSDEEP
6144:zI9DJjSFOJcuf4DUyN1+rOHyHq/E7Q4H3FidYSj5wbBRe:zI9ljSFFW49X92
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2092755520:AAFUT-2SMjjd39KTAiZYfccbaFzWXamzjz4/
Signatures
-
Agenttesla family
Files
-
3604-138-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ