Behavioral task
behavioral1
Sample
4876-134-0x0000000000400000-0x0000000000468000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4876-134-0x0000000000400000-0x0000000000468000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4876-134-0x0000000000400000-0x0000000000468000-memory.dmp
-
Size
416KB
-
MD5
aee73a091ad28f8cb4388b3c272ba7eb
-
SHA1
668a91e41f5b8302afc3b8d94a5fd57b80b08db1
-
SHA256
b44b3c797a6842c42e9c064cac3383e9ebd6bc88b5a4496f11c8372e0a643d3a
-
SHA512
d385dfb3575e50bcbc1890d57a34fc7643e36ef46c75090d49e5244208c467be7ba6716002b313e660b2d5526738df42277f5bad33638efa620b2136cf25bbdf
-
SSDEEP
6144:7yYepPz3wUJIn3XtjrZlhI27Qrmu5GcuM6bbvjZr:+nL3GrZMsY5G0u
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
tqzwrcdhriqzrjyb
Signatures
-
Agenttesla family
Files
-
4876-134-0x0000000000400000-0x0000000000468000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ