Behavioral task
behavioral1
Sample
1688-63-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1688-63-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1688-63-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
832ea063e7ce2651c11a4b95b6048918
-
SHA1
73e30c5d7b9ba54b090f57257619cfc122af380f
-
SHA256
cdd73e06e5507ba5db52b423e2fc4a07ab6c0a0250b628c8b5e9ccf0a7749fa5
-
SHA512
5e554c274b07baaf10cee44755d91ed8eccd4c5d84d4f61c07dd21c7074cba1909f164ca6a3a168a5a07f80921acc27430c43fa272b10aa2e92a90c17fa43b2b
-
SSDEEP
3072:5AEIi3X7pejfo57IZKxF8vF7E3UsJW0m1ImzkfpETiCfKkA/OKzrd/Nz:5IAeSxWa3UUWjBUpETifk8OMrlNz
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
server196.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
lagos@123 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1688-63-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ