Behavioral task
behavioral1
Sample
1456-60-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1456-60-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1456-60-0x0000000000400000-0x0000000000438000-memory.dmp
-
Size
224KB
-
MD5
c70f7f3d11b5e63de9be1089eb062ce1
-
SHA1
0ae538be60950026ec2849ac47e2cce07b490383
-
SHA256
ffa719dd10c63468d9e2996e6f91f12c4a3851c318d844c27d2023c141594314
-
SHA512
5f44640c3a95b8020ed35fe18791d6e37a93870be0c661259d98e569adee9cc7fa804deefae90e9ea255c0475fd02ad227fe1615e41213315b1b691a17105e1d
-
SSDEEP
3072:Gj4hcbHabeiLOn4KYUpvpmx5UFkpLj57WRK1YS8HO8+CqMIrPp:9GbGK765UepLj9WRK1YATCqlr
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5988122207:AAF1_KgDENpI5X2i7Phd669ok2u6BhL3kK0/
Signatures
-
Agenttesla family
Files
-
1456-60-0x0000000000400000-0x0000000000438000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ