Behavioral task
behavioral1
Sample
776-67-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
776-67-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
776-67-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
3f0a3f1a195667eca28cf14a1d117c8c
-
SHA1
990678228f26bf78720f5ac29e089c4534cedce9
-
SHA256
c7b3da85c79edfb50f2cfa307b361310bf3546e656ed09f3df28d08333e06b74
-
SHA512
3bc4b8991ff24c1335ce4007ef2511bdc83bf4845d77310da05debadcc52b1d1c889fb10897eb17b944e0b927fe8ebc684069a6c491b0e086510cfefeda75f20
-
SSDEEP
3072:hmxm3g8xz6bIoukJUzEAoNw/tdBEdPlqCTKs0W+DAqWn2mF31ndLFG:hqHNIBIUzEAqwcPlqCTKs0WYot1dL
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5896568959:AAEnkyovAgM2FC6R57hN5WEZdDJkO1x6qLE/
Signatures
-
Agenttesla family
Files
-
776-67-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ