Behavioral task
behavioral1
Sample
1860-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1860-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1860-63-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
bc70d4f5cf6b63bca61b264e88a229ca
-
SHA1
2535c3849030ab089d74b8394600874f613b6e5b
-
SHA256
5e73ced06ab0b05a3ba3a4d62d64e76cdc334f2e2ccc22d43eb3cdbc780d44cd
-
SHA512
31be29b54e65409b81787dea6bdfc4ba657a5284fdf3d5e83b76874424ae001e2156b2350ec88d475c939d6d0dfea45dccb47e4cde3a46a951a5dc32492e833a
-
SSDEEP
3072:hFUC6rPg0/g61tzbZCVu1n2cffd7AdGbgTufZT2M4KBzPa9Aj:hFlu1t/ZSU2ifuEdZSSNaOj
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
$yBIMj^3 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1860-63-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ