Behavioral task
behavioral1
Sample
4540-151-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4540-151-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4540-151-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
b4eac3a6b7533e8b659b2fa33240c408
-
SHA1
273a03b54cfe2b146888d3f2fbaf997933f223dc
-
SHA256
f14474af7f50b231325afeb7a12e521994c7fb409d2d0231519e063773313cb0
-
SHA512
ae94585c066fa42ed09cfab5d30beba46efb3eb4628a1a87dd21a3904eaac01027746da748ab26c3e521d086b8d7c397fa34227233b974de5d46ea5adac171b0
-
SSDEEP
3072:BE4rtwtO+efAydGJ4+JEd5WKzMR9MUsn6A0Scpc/uKVFGfHNm2t101gc6r+/C0m:BVreeCm3xfUI6AucPV8PNF+1gZrqC0
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1836400811:AAHbceSsBewgu2-18DdhyOIr5kwyIr-_36E/
Signatures
-
Agenttesla family
Files
-
4540-151-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ