Behavioral task
behavioral1
Sample
1448-65-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1448-65-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1448-65-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
407d75c9ab59bc35ec3639740ad6f818
-
SHA1
91e378d2fe981583e40b264c9f36af0c69c14035
-
SHA256
40ca06fd58d9fd56ab769c4e0ec5844a3e43783b998bac9d1ec4fd726901171c
-
SHA512
ec729bec45c2d5fa38def5a11fa7c67de31b63a15854ba84944bed6afa936b6c98b813cfe7503d9c836be82a0227d9ff4705f4ffb40d4c0a7b49156467222fff
-
SSDEEP
3072:/BP5UbN7bD6GPtf7cCjCuf+KjpjVeHKLL/i6KWI:/BPwtxjfZjpjVtn/93
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1448-65-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ