Behavioral task
behavioral1
Sample
272-64-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
272-64-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
272-64-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
9a861a92e9a0a88b0cd653dee96f9f9f
-
SHA1
820ae0e61d105a0334d573b8d7ed5a75fe10f50f
-
SHA256
2b7766cf9d7cfc12aa00057fa9b1455ad5fbf0ae6bd1141af61d2cf5f6529be7
-
SHA512
02e1d879bdc33c3e5e42e82e9395ce0c8ed58fe89e9ce18cf29a0ba5167936e4e6787145fad578978b334163e18fe3e5bc2976cf4e7876f122dd4e024ba4922a
-
SSDEEP
3072:/oM1wg0bYRzBeDN9EGBv69c0vy/7KPgqKjkA2sge6OLjhi:AM0EdBeDNOxdvyDPqgU
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bestcargologistics.com - Port:
587 - Username:
[email protected] - Password:
7Lalpir86 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
272-64-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ