Behavioral task
behavioral1
Sample
4712-134-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4712-134-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
4712-134-0x0000000000400000-0x0000000000438000-memory.dmp
-
Size
224KB
-
MD5
5774f8d9bae6bf0afcd031ef4fe30a77
-
SHA1
84e3e586e667a0832483f3e3be2a3e596019fa29
-
SHA256
dabb87740171c284fb047bd4f754d43240f0488ee2187f22414b73f6f0563dcd
-
SHA512
a1ebf40f7973e7f6953bb4efb641296e51e39150bb290e4493a3732afa0cbd020ddf6ac7ff18d5418563eac324790e1a5cc40e4ae974672cdfa58f54aa907096
-
SSDEEP
3072:1u/ZvxRj7V3MVAAUO+FR0QU3RxCrbcWyaWV0dGGIseuP/1Eany6xHGc4rhCj:Qx5eVZUJyQUzoAWmV0dGytHGPr
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5476363134:AAGDVRgf1FvUCgwpScNiSNbs5wSfT7RjpoM/
Signatures
-
Agenttesla family
Files
-
4712-134-0x0000000000400000-0x0000000000438000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ