Behavioral task
behavioral1
Sample
3172-150-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3172-150-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3172-150-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
9757980c1c41feb5dceba836cffbd0f0
-
SHA1
c0f29fdafd6a024445f700a6659a1cbbd413fd15
-
SHA256
4c14d87924d371846d797fd7d0aee5759620dd56ceecf0b31636fe2fedb48ccb
-
SHA512
e515f87880de26c9e9dd7b30fd234d84dc9316e6ff8c98d9b27c338ec1a36d90df75446f1a729c9411357e30f4e64e602886f49114e6bd45113e47dffc4a5d42
-
SSDEEP
3072:kvfjYmFnFvM1Lw01vBQY4YfgbdBImxG4uciJl5h:k3UcIk0TQogbvsOiD5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nikisdream.gr - Port:
587 - Username:
[email protected] - Password:
Jb6ll47$ - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
3172-150-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ