Behavioral task
behavioral1
Sample
2016-65-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2016-65-0x0000000000400000-0x000000000042E000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2016-65-0x0000000000400000-0x000000000042E000-memory.dmp
-
Size
184KB
-
MD5
cdd28c3c20721b2e14af59bdbbea5ea4
-
SHA1
a8850231513d8360b6b96d89c4a96e6b96d945cd
-
SHA256
55b12db7eb83c360a017cb5ae07f36bc14596ff73f82a1b58d9aa1daa8e14ff8
-
SHA512
48f216c8062e41dd7a70b0796ecd72250031418438e0b729b4892ac76263c24d861d640f9876dc6210d0b1abbcf3204ebecf0a7fb8f6ca36e11ea55fd548075c
-
SSDEEP
3072:t0kmV4h6CPs/gBuUA5TJlHOr9PZoJzzKzVhoLNMqk1Hd7b3Mv:tNoCPklUAla9mJzzKzVhoZM1197
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
@ossai1111
Signatures
-
Agenttesla family
Files
-
2016-65-0x0000000000400000-0x000000000042E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ