Behavioral task
behavioral1
Sample
972-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
972-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
972-62-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
bafa6da8086899b247e360bd29fd07dd
-
SHA1
7ee3bd878b4a51ec4c9bca4af3826a52af935f89
-
SHA256
2d00f54c4d790854e48b64da6e8e8082eefc719059f4e9e474f24f8a93b2ac8e
-
SHA512
28d1a843e1cf76bbd986a4fdcdc3607910890c2d80cbed0c6e482d9a4c67b45e0c09df8e13f04ba0b35d6f59d4681ac2d7b6785cb8a35939ee2449a5af8a881d
-
SSDEEP
3072:0bQhMulkm2x68KrtUtCgDeDwKgPS5xcZEcmriQo:Zh2m4TvRaDLAiZjo
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Signatures
-
Agenttesla family
Files
-
972-62-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ