Behavioral task
behavioral1
Sample
1200-82-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1200-82-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1200-82-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
67af3a9a16c172312fd931bbc80a9b6d
-
SHA1
1fe4321652d791cc1074ac5918d3ca384ec3665c
-
SHA256
a45181f84e6198e9bef4a37d435d33577c5a4afcfb1eb90593c0c94a7393c3df
-
SHA512
9405223270a7223225b3b8802e73206b3b5181e210d3cdae9b5e33af5fe7933468c012d2a3070baff9ffc57f17dff3580c3337da47e48723588cfb95b3942ab7
-
SSDEEP
3072:E/7wK8DuqFxmnQLuui1sGy6N8ydLrOAyw0euZTv1HQhb5kh3:6sV0ne0KZeldL392TNuw3
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6134322066:AAGVSHy194hgr5YD6BWqOrCfApFRSyuNjsA/
Signatures
-
Agenttesla family
Files
-
1200-82-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ