Behavioral task
behavioral1
Sample
860-68-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
860-68-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
860-68-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
16fa749b8efcd13acfe61bbdd87abe67
-
SHA1
08572b4c60518fe5e81ad7fd73c3616a3a18e15a
-
SHA256
a5f647642ecf190bac464479c5a8a867547224c2459d69bf0eb605dae20ff3db
-
SHA512
4258d2408f1b49b1c7b82fc28c1321009e7d0b2cd60d55c8150af4fbd710540b74f46ce4eecb2e79ea19de465bf4237c656ce339d9054513d5ac2d19f0143711
-
SSDEEP
3072:Vv97sb4vqlc7FvhUQCB3dFZ3oRwl9L95mm3PkNj:VvDylAjdCDFft95Fsj
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6126200999:AAGl6SGptu7yDfEtkr6O0gjkZAOexeUyH6E/
Signatures
-
Agenttesla family
Files
-
860-68-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ