Behavioral task
behavioral1
Sample
1528-68-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1528-68-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1528-68-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
a59d40a811b62f66820c0a5ebe14a054
-
SHA1
5ef19bdc65a4d9bec5298ad66e736db29752ce00
-
SHA256
dfd525156a0385830943ba5d182b52622a08027b48ee6d8516d0d99c5a23e0d2
-
SHA512
7c3276f6f3cb609884208294e469ff371f51eca49783c9ba76a725e59ae6411af1593a3d455407c61be991ebcb7d6bcf79100a2444f7b06667e5a2163c2a30b8
-
SSDEEP
3072:JMVNhOHoVHZbJ0kL6WU7HxvV4r6DytSVebQ3EohJ:JMQIFdV+HLcrgqS6/gJ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5482315235:AAGwacbjVLMaBQENAXUuPyVg-cvhlK0vn-w/
Signatures
-
Agenttesla family
Files
-
1528-68-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ