Behavioral task
behavioral1
Sample
1640-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1640-63-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1640-63-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
11dab50208c8a0edad177a42ecfa6aa2
-
SHA1
e5f1bfb682acc48467bdbbc0ee67a5ee0f43a286
-
SHA256
f5812f71babec7a2d4b6dad443981f10f014c2ad633d5771634ba8eb8589c1f9
-
SHA512
598c974aca2bbeb62c406da57b0c3423ba7fc7b5addb20d1ac33ef6b7d19318406879993b2ffb1bb2c65ad00dcd6c5640c422b47e48366cca9fa9b3478b096ae
-
SSDEEP
3072:jOvmgWk5S15mOreF7LyOkN9nkEwmx7bNWHlVYHVVUUUUVnV3XLjIlID69LXKaaU3:jgmgn5S15mOreF7LyLVkMvhqLXKuqLDO
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
host43.registrar-servers.com - Port:
587 - Username:
[email protected] - Password:
lC9xdRZ jComP - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1640-63-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ