Behavioral task
behavioral1
Sample
1304-67-0x00000000003B0000-0x00000000003E0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1304-67-0x00000000003B0000-0x00000000003E0000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1304-67-0x00000000003B0000-0x00000000003E0000-memory.dmp
-
Size
192KB
-
MD5
91dcdf2b573a2e21e6a915f7da49763d
-
SHA1
d2219474a64c9a08dfb24a19e526c0cbfc987431
-
SHA256
e19687a2b2562b8a15bb241ec7b1def3d2abd4e40c335911b2980a29d33c36cd
-
SHA512
eaca3e1468b1c27210a0127ce9cf2edbd43ece754931e488d64f1a8be35f085644625d6edc224d39018eccfe11234b9372293ad400a6b0e151d665c6b1bce73a
-
SSDEEP
3072:Ako1nTiCaIu+1088vPC/FB4KRDz0MAjdpKRiLs+Vg5z:AtzaEz8HCD4Wz0MAj+oI+a5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.galaxybreakdown.co.za - Port:
587 - Username:
[email protected] - Password:
eva369 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1304-67-0x00000000003B0000-0x00000000003E0000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ