Behavioral task
behavioral1
Sample
320-63-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
320-63-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
320-63-0x0000000000400000-0x0000000000438000-memory.dmp
-
Size
224KB
-
MD5
62ad1f1309c33db7fde8479b7b664a31
-
SHA1
c1462c3a68322707647edd6477d4e0228443e07c
-
SHA256
d5b9df8a8b32c5827200afd0ab01c2e75a62e79dfb5c3f5c8afd4af4cc853580
-
SHA512
c0f5590911167566af869cd47d41a7ce953f822c63a4b996aecc030d97dc2cbbbed77d85d06fcd3151d4ae151a2e415327b90be1d28fd12072e960be4a9f301c
-
SSDEEP
3072:GwEDU7HabeiLOk4KYgpvEmJOU5HIKZ7qrtauceH+I1fVrAIrDp:wo7nKP1OU9IKZ6tatXCFpr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.btlntcrnet.com - Port:
587 - Username:
[email protected] - Password:
Gosky080$
Signatures
-
Agenttesla family
Files
-
320-63-0x0000000000400000-0x0000000000438000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ