Behavioral task
behavioral1
Sample
912-70-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
912-70-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
912-70-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
50a1e562e84021c3182441695970f133
-
SHA1
7a6c877120740f7496c89be9b47e5bb0a152d864
-
SHA256
43026b135fd6555c4263daeb37a21dfddf9a35be9f8787f23c31237131f8456d
-
SHA512
958374486fe136f58f04b5323a1affb11c842a2648fbbdade2d5ab1796b41036a6fbca30b443aeff1088dcaeceff771c3cc461b63cd89efa108922a720c58b85
-
SSDEEP
3072:SrRBOMEjxpmHDm1Hl6mqq5jaZ79rjMJgWYUkvxRZ7c+VJm7aTx:8RBOtnmj0Ff5jwdYZYpV7pWuTx
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5635409590:AAHInAR4dWLcsUes3TU8Nj2UQrEubKrXKLs/
Signatures
-
Agenttesla family
Files
-
912-70-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ