Behavioral task
behavioral1
Sample
580-63-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
580-63-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
580-63-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
6e31810c321295c2f5f1b0dca2023c01
-
SHA1
9b1ada0b5c56e834063a75fdd336177c97d787af
-
SHA256
9ce0ce171de6bad38df6bafee10bb08f4760ea43a2e4a8dac57dfdf7e66e83be
-
SHA512
eae0e1248aa7ab4afb99e4aea40ae4fb083c312c76e7def79a459d559c441ad9f0df2448e75c890f77cdbcedaa1bad7b4f78ebf713d36b12cdb26b48a21a269a
-
SSDEEP
6144:/cDWCL7NQiHExUS7vFSK2lF6GBTur51I:A37hHEbGJUI
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
host39.registrar-servers.com - Port:
587 - Username:
[email protected] - Password:
bRm bw} Cr+ Tth
Signatures
-
Agenttesla family
Files
-
580-63-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ