Behavioral task
behavioral1
Sample
1736-144-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1736-144-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1736-144-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
c21a24d1785c6d2d01c7c0b826c00b30
-
SHA1
904eab26282db0fe525e88d4b9aaff126bf43118
-
SHA256
46ac4d6e0d2ebb77e77e852eaf0e9f7d06cf22312cf08c15e674ab4d99d2b9d2
-
SHA512
0dfecbd0bbf9a9160d56d2ed25dbcace8ba7e42f7e0c6b37159f6c270d6c31e4ef54d6df58c1cd1aaaf7590f7710d09a0817ad75de9638f0cfdcfc6ffc6f1214
-
SSDEEP
3072:NHDFEW+3Q7jEJIbt3EMVAXRFrVZU3v8K1zks2SzarpG:NHxEQ7jNAEv8zs2Bp
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/
Signatures
-
Agenttesla family
Files
-
1736-144-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ