Behavioral task
behavioral1
Sample
4016-147-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4016-147-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4016-147-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
4775592feb16ca5944d0c87bb73ff848
-
SHA1
e1653db1aefff41e9fda5f97d5ace1efd7b70eab
-
SHA256
08e7b9a84d330afe12d130b61b07626bc1d0569febbe6e0841755bf2c3c5a147
-
SHA512
5b21ade361e831b300e27f6881ead79abea3f5385dec5f407d983309b004a0383a91c09095a4cd10ea248d6af617aa5418892472502000253ae1db9787f1ad82
-
SSDEEP
3072:S8bN8c4ozVaapUnK03hf5K1GwJ086mZweUwPXmpWq:SQ8W0rS08RZ9LP2I
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.clipjoint.co.nz - Port:
587 - Username:
[email protected] - Password:
melandloz64 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
4016-147-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ