Behavioral task
behavioral1
Sample
1456-76-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1456-76-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1456-76-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
16fb6264c100163a0cb0b386bc9553df
-
SHA1
2a8d450c8f44f220c0217dfc13d90710c728cabc
-
SHA256
02f5000f1664f9f39656bea7a5a79110a58d65703aa279606ce95736672afd1a
-
SHA512
0e4ef0956d571b5b0e15e9a71129569388716ed8f08f4ca8b576d79df29439917e5913c5f738db87ac3ffae2610a18a51cf48f586cb2c8af26bc944070d195b5
-
SSDEEP
3072:ssg1/syAnptyRH1ea++Otd0OHZpK6R+uS5nh9VnVmDUXOS6K7K/4:Dg1ktwVb+dtd0KZpPK5ndnV7nu/
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6145149580:AAGlu9vZ9LvBaA2nRQJbqSpXqzQLKqmpjQE/
Signatures
-
Agenttesla family
Files
-
1456-76-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ