Behavioral task
behavioral1
Sample
1412-83-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1412-83-0x0000000000400000-0x0000000000615000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1412-83-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
2c6ca3ea968f6048b819cc7d822793fc
-
SHA1
3f4975f1edb9d757e557c350f8e8663c6b30a545
-
SHA256
fe45dce9e0b5df81abe4d760695ee5f61d1d063cd7ffcf1b0b11af40c990f6a3
-
SHA512
8f6a5c41ad6d6b8eefb0d0a78a021734c48d31a195315e1fdbab1ce3def73028e4d0cbe25d203453dcbee092c1da47c7ad076b53335e957ffd00eb2fd8a76280
-
SSDEEP
3072:uYmo8n9NB1OHVT6CPR8EG1e8SMPiKZnIEeHujz:umwjIWCPuEkS0dDeOj
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.1and1.es - Port:
587 - Username:
[email protected] - Password:
EventosCamar2014 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1412-83-0x0000000000400000-0x0000000000615000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ