Behavioral task
behavioral1
Sample
3588-141-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3588-141-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3588-141-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
b2a71709fcd9719179fc4f72a620f8ba
-
SHA1
b518f149941b05346e84337a5274a3c9bce00b69
-
SHA256
d8c6eb6471af2fa3f9ec1bf2504e37449d838619c3b5f68cbb37404551f872a6
-
SHA512
d7aa5eda47b66293939fe904b49484d628c94690c88c1f22bf384724949a57f7530e098ce0550019799bafa9ac76411567a3e5df955a8692a65f8d666d66e18d
-
SSDEEP
3072:TRB/fqrQ6E8M4oHE1HjOkbpmb6lvNhnGubJRQ6bx7kOnAb5U+pjzGNB:TRB/oM4EWDOqpmbCvLtvBvAbWOCN
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5846767138:AAHbrIUF1epdWlFQ2_64LCd8vdF121y1XGE/
Signatures
-
Agenttesla family
Files
-
3588-141-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ