Behavioral task
behavioral1
Sample
848-71-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
848-71-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
848-71-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
b6d5b905efcfc64c563854c13f3c30b9
-
SHA1
43535369c25ba1b1e32d087366c100c1eab5ece0
-
SHA256
174ee5119eebc5ba5a9c1d3ef4314c763b00cd1a4700ed035a4b5488accd20b6
-
SHA512
2dd29569fe0b71e678d1a6ae2d66daa8b5453d1e60f4c99b0d54d2adbaab0c166eaac5fd28e55069300ddd6dc4efb17f75dd73bef7b21dcb39c85922e848b927
-
SSDEEP
3072:APeV3s+HQXVB9FKtq1UVsoEw92ueG9Ouo002ktEpEvlpBOd564:AvxB9ctexoR9k0bgEal7KM4
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6096662297:AAG_p__MDOrl-GW8m1_d4KE8lp9LaFVvEfM/
Signatures
-
Agenttesla family
Files
-
848-71-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ