Behavioral task
behavioral1
Sample
1368-139-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1368-139-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1368-139-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
4d5633bdec36b083160f4b6644900f8f
-
SHA1
9ff73eb7480bb1f48706bf2223c7d86624bb0bdb
-
SHA256
592669ccd801e96d62c3174d369d2e165caba7c8c6acf9edbba10b96baf813ed
-
SHA512
e059bc595a0c4ff4ea32e5d1025e91393a2c522aaedea93905b7423a5352ae9d71e535e92a6cde7fa4e38713af5fa257cb96b74d0d00367e6053a9e7b0695c2f
-
SSDEEP
3072:wRBoYX8vD0ibr1D5bJm+p3+mR4JoSwVp0+rHx7t7PM30nz9cpA:wRBe02h1bs+pOm6Wl1Xhz9
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5350270151:AAHiqzi7CQnEGEk3Xi-PyJX8ov0x6B-8S1I/
Signatures
-
Agenttesla family
Files
-
1368-139-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ