Behavioral task
behavioral1
Sample
436-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
436-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
436-63-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
64039108f80a0aab60f13c72510c840f
-
SHA1
87dd0320d6720a643456fc8dbcf40cb4950ab3dd
-
SHA256
265051d96449bd95b6eb40c367c103fb6fb136c465059c404b903a90a22f1aa9
-
SHA512
54c99ad50664fe7cbdad60a6400002bf19ad84f6527ca585ca630043f4ed8bf12e4bd1eb1dee1173c20c8ddc11bf9d0e7335345eccd64d0a862585657876d7f4
-
SSDEEP
3072:XM1Ca2sv1a0iZH81EdY+eHLs9kaZbT3D5UlEVfYL+0YzIjdtU9:XM1CU3iR+7BHYieL5UlVL2zS+9
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6127975868:AAHe9_HdeyVjj_GUNUbUWkUihJckzlPKmEc/
Signatures
-
Agenttesla family
Files
-
436-63-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ