Behavioral task
behavioral1
Sample
980-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
980-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
980-62-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
6514581a20bde58270b2967c9895a1f8
-
SHA1
bef1253a8f09673f65ee082cf27d2672bd732be5
-
SHA256
f1231b332e09b5225ae89598fbfc63914756de5fc4fb3127ec5fa851d938bffa
-
SHA512
0778e9899db0b83186e6cfbf6097a296a367c3f0f707dfcd13ebd650e889bb467b5dc73638f6d467184c1045b5315acef5fb957182afbc7ee1d67097a6b66029
-
SSDEEP
3072:9ggzc7OF+42r/+9+0U4gbCfPlabfsXLm5m8tjgD6gWnGd+9Gx:9gvSF+42r/+NEGlOAy5/jYeGd+I
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5700247611:AAEzrViORjqkWwP325wS-O3Mi1nOD6uBZcM/
Signatures
-
Agenttesla family
Files
-
980-62-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ