Behavioral task
behavioral1
Sample
1712-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1712-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1712-63-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
67fbc9507f4a77df86f7ffcb415db308
-
SHA1
af247b482fa1be26f9801df133e3366f9a20b03b
-
SHA256
497185219ead8caf4b4a6ae21e7a1892ee72c8a8b4f207f98a71601a5afbf108
-
SHA512
49aaf10c8d1680b1d52b062bc5419cfa6a81373e0049493678299db40ca05cdcbebe72ec5dd63f9e16bcbac86de9023efae3bf6d6e77a25b7ff2d9d63fe2be5f
-
SSDEEP
3072:wRBoYX8vD0ibr1D5bJm+p3+mR4JoSwVp0+rHx7t7PM30nz9:wRBe02h1bs+pOm6Wl1Xhz9
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5350270151:AAHiqzi7CQnEGEk3Xi-PyJX8ov0x6B-8S1I/
Signatures
-
Agenttesla family
Files
-
1712-63-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ