Behavioral task
behavioral1
Sample
1972-88-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1972-88-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1972-88-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
9cdc47f2838f692fce2fb7ca17f4d49e
-
SHA1
76adbdca993f2fd0877f26966564b40a4bf6cea1
-
SHA256
55b79e625dfec9de3881d049c01db165f882ca471038f03537ba58a6900e96a4
-
SHA512
155aec8fd5999255974e539bdbee32939cd7ea1be327ce1d67db1f1607da0d1fc06248f3deb09a782c5d5603f10dd5bf8e80beaeb882c458270fb4818c685a59
-
SSDEEP
3072:ZGZUBRjKXNmlaOXbdHh2E0kr0bQoi9cyQmBRWuZzbn2+LQdGFcuKnmTru:ZGZUBFomlaOhnfrcyQYhFcVmf
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5687731944:AAEDpsUftmaHrKNSGkOlhq0UZLPEvIUd8Bo/
Signatures
-
Agenttesla family
Files
-
1972-88-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ