Behavioral task
behavioral1
Sample
876-64-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
876-64-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
876-64-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
d1f4813dde286c88dab8ed4d019c9c56
-
SHA1
d97167168e40f9775c3ad097244c4479e71602c9
-
SHA256
3639f785cb8385b763a289948f72767917d72db4f0c003745fbf3f05669c33bf
-
SHA512
b4853ef83fd83e1bc857bf1be1ca4e34e426961f99d5253f26d5339102aebb2ff37a3fc130b926bf6f1b9cdabea19469734223cf1da44e7fb34e8d75d7b10aa4
-
SSDEEP
3072:m5NHWjIU0oAyhIescakofaI/Z3qH155Jnm5/G1Xq86FrnP8SffqY2KwfSRbTd:TIaI/te5Tm5e5r6GSX2KHVT
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
JUGCRsm9 - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
876-64-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ