Behavioral task
behavioral1
Sample
1376-66-0x00000000003A0000-0x00000000003DC000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1376-66-0x00000000003A0000-0x00000000003DC000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1376-66-0x00000000003A0000-0x00000000003DC000-memory.dmp
-
Size
240KB
-
MD5
1830979331eb846e2eb59b6972f16b4c
-
SHA1
316533ad2f9f79e540303066ccb4a144069e886f
-
SHA256
c1d03d97ee789961956fcce9d7cfa2d120e49eccc95833bfab8143d9c2d51c40
-
SHA512
884885c628976092d1ababf70246da3c353f5611999da1ddd2dffc5103d90a3d5e09aea33794f02fe63f41254b37e231a05753d10bb5a6e060df314b98e9ee28
-
SSDEEP
6144:RyHZCCGUvcUsKpwX4O1aheJrUoKWgrHQq:EH6UvptWbq
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5663632223:AAG5KHZDs7KWoaqTYx3lSyFlOdfD9vGegQo/
Signatures
-
Agenttesla family
Files
-
1376-66-0x00000000003A0000-0x00000000003DC000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ