Behavioral task
behavioral1
Sample
2040-149-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2040-149-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2040-149-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
34b80ea22d753caa97de3d144da4222e
-
SHA1
47afd927a03829f872e22ce9a857f9d78e261847
-
SHA256
ec6ecf7b5a696c3819a8c783be794591a4cde8913a88c60ed25753cf88f33372
-
SHA512
43d646bfd999c5fea0b70c391eff99b9282c55ab523d20af96f3ccbbecb54c6c46ff21e5b5c62078059d04a72dc9b43acd89f7dc375789530c50a39ca99e3ce7
-
SSDEEP
3072:oyLMHFvr/Vf1EhEOs0r2VUqlRko2/Sz+NTvdE8zP5ga1:QvTvEKXw29lt2/Sz+hh+a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.eventcenter.am - Port:
587 - Username:
[email protected] - Password:
[.YAwrF93i~t - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
2040-149-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ