Behavioral task
behavioral1
Sample
1204-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1204-62-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1204-62-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
f287111ffc59cd265d0f0177a5ca8ec7
-
SHA1
0e7bbedf3a6b31535ca593b2c68aab391f3647a8
-
SHA256
c97cb94e9946d8c5261fe04d511855c05e9b85c2f5bcb85100d9926e15d05902
-
SHA512
08ca4251469f62828bf26895c7c987f8862a984b3f37378d2231226b44f227387145d0f8cfb6dd832f55d95f5450ff27528e8fbbe526bebee9da600e7b43ef7b
-
SSDEEP
3072:le3Pvhf3HuN0v1RrMt6AtrQ6J+YaDgEATVpKR0zbXNB3:YfXD5etAYvbWGXP3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.focuzpartsmart.com - Port:
587 - Username:
[email protected] - Password:
FpmJhn@2023 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1204-62-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ