Behavioral task
behavioral1
Sample
1488-64-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1488-64-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1488-64-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
cd3defd1769d103e10218bcb619f16fa
-
SHA1
8c6145ddb70a27c7ca1c667e4aea5521c42b02ad
-
SHA256
b48b975348f50eb4467738b12fca6558da721c7394413e6e458c84ecce491953
-
SHA512
f6c2f540126abab125c7bf096341b0b174a99c18b7df4aecb4994959421a5f2f1f5113c712e255a5ad50f99f8ea65c5544a504f45455729a68ee5ba0ac720798
-
SSDEEP
3072:Te2rwrjETYeq5kJIgsl3M9NN2g23UKrfcmRtfcIE1:TeWZT33elK2pAatct1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.woxi.cz - Port:
587 - Username:
[email protected] - Password:
bg58gt - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1488-64-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ