Behavioral task
behavioral1
Sample
5108-144-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5108-144-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
5108-144-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
fdb50e08291f91af3a8913af7569e664
-
SHA1
ea75a46efa2e18cf7b12fa93d5dda4a86379d985
-
SHA256
d2cd5d4efc69d49a51653bd1ee1949dba4df4bcbf97b2aecf8572f35e4756022
-
SHA512
1ade885b7c041e0cc2bb9a929d26af030822317dc52c1a6f3756fc3a0f5ae2654ffafce8a4b93b6bd47e4fc9cd5758716ffcda7a9b9d5899e7b605955c774116
-
SSDEEP
3072:hmxm3g8xz6bIoukJUzEAoNw/tdBEdPlqCTKs0W+DAqWn2mF31ndLFGf:hqHNIBIUzEAqwcPlqCTKs0WYot1dL
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5896568959:AAEnkyovAgM2FC6R57hN5WEZdDJkO1x6qLE/
Signatures
-
Agenttesla family
Files
-
5108-144-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ