Behavioral task
behavioral1
Sample
1208-63-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1208-63-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1208-63-0x0000000000400000-0x0000000000438000-memory.dmp
-
Size
224KB
-
MD5
a44fa80d7b7d870d48000331913c046b
-
SHA1
c2955cb7f63a92c2e764bdf873be90a5263ed2f9
-
SHA256
557de7347fb901fd5b2499f02a85c7b98b0f21715744c916c661a38a5c159a6b
-
SHA512
87f5765cdbbc73eeb751c0b624081882f7fef535706eceabfff3ed0fb2d3d7a3293c544473484f3ca03e57026da944f0a78ea8799b387f9d68031e718f76c03a
-
SSDEEP
3072:xJ89WlGb4i1/2CTcrPLam8XUqhNJdpgebaraHR2VYiYxbGg0NWExv/sHDrVrO:4ol/PuXUMNJdpzb0aHRQYiq0oExvkjr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pumaelektrik.com - Port:
587 - Username:
[email protected] - Password:
cspen@#$123 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1208-63-0x0000000000400000-0x0000000000438000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ