Behavioral task
behavioral1
Sample
1916-86-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1916-86-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1916-86-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
c8266e01a2ab22c8ba1fd0474d2b7863
-
SHA1
07240642076caf2bf84116f868c50bf2e172c0d2
-
SHA256
7158f3a51735c428face0ec7bc82fc91b8f200a5068918a751d69c6ba6cde0c2
-
SHA512
0061e0a700788a510e59f9a364104d21fafb5c1b97f99de99bb6933bbcb1e7be6186e45ee428f52f966a48cc3f8485064fff2983b20684b2dd8372b6ed8b97d4
-
SSDEEP
6144:sCteODDguzK73ejrNxdmL1qRs1KKqeGSY8A:se3IubDkpqOQmGyA
Malware Config
Signatures
-
Agenttesla family
-
resource yara_rule sample upx
Files
-
1916-86-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 144KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 118KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE