Behavioral task
behavioral1
Sample
1044-71-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1044-71-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1044-71-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
88f32fbb3af23dc0d18f9b8561d08d5b
-
SHA1
201c5d7a78d5850b3bf62befcedfa0fee2888552
-
SHA256
be9f07693dabd93bfe0f02cabcf04771549bff8d1d20030403f82074f43296f9
-
SHA512
021f6b780d155f475ef2d1e83f852359ef4898ae8c8ea32e7379104d921607b694231e9b698a9478e3391b5f44933f3bc469acbc49159581b1a4170545d8ac29
-
SSDEEP
3072:qtcy2rfXVykVHj8O6Bi06C6CKiTWvRYRBVl+owSy:qYXVyYYOoACOiSvRMBvZy
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
y#eeW#*kJ9 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1044-71-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ