Behavioral task
behavioral1
Sample
112-138-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
112-138-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
112-138-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
3b48a79520074ab9426f74420ce6ac76
-
SHA1
b6c30f3b295bcfef92c68e600ef0eb0b8daf395d
-
SHA256
309f21618452bfb7ca70d9c14bef4bd1add7504007467d796785791376e3f6fe
-
SHA512
b48bcb08a3dee7c57d193821f26f45bc9d4eff3742f13473c69c4e8d99ac32d20c1e3a53351e3dc94367bb726abfe31361314e9dbc1580625c1775392831dfcf
-
SSDEEP
3072:rM1A1+P4IbI3py3V1HcHIOfSZCO59vIVW3K5l95UEG7+Yd91cr+qcrN9:rM1An3pSH8PfuCOXSl95FG7Bc5aN
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6027889379:AAE4LzvdIejVEe0wcMjLQpyhO0kws1RK6BY/
Signatures
-
Agenttesla family
Files
-
112-138-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ