Behavioral task
behavioral1
Sample
320-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
320-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
320-62-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
163c328c73366c29d7668e73ed890e0f
-
SHA1
c0fb4d4563a7763276ffc1fe3a11da8f507d3f84
-
SHA256
1ba0f88f15586d28cd406b4dddf8529a7c933effb3c2400d22399740bf070200
-
SHA512
61e9b87c14502409fab5fc4e498cd9eda002b535a4565a316cb5a9771be494312b396de74b508c1520bcb293edbc56ef789ad11aebbe82396b7f2ecf8de14d1b
-
SSDEEP
3072:X0w9yl2qHcEXOl5kPc13x4ILDANN/K0PC:9+HIacV7fAXikC
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shjavid.com - Port:
587 - Username:
[email protected] - Password:
Ainfo5221 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
320-62-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ