Behavioral task
behavioral1
Sample
1724-57-0x0000000000090000-0x00000000000C0000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1724-57-0x0000000000090000-0x00000000000C0000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1724-57-0x0000000000090000-0x00000000000C0000-memory.dmp
-
Size
192KB
-
MD5
27fc20e7c8a70c028f09b3f80bfeb29d
-
SHA1
ec6b480b1d5b0d9121a48177ae1c1161ee3d720e
-
SHA256
d923d8f90a3885b0ba62ab0a8a6d51e6b9a91dd402f8d743ee57627e0efc3928
-
SHA512
c6dbcccfce5db3c8ba21a61b4e3fa463d7a310e4372c9e010f3b17f01bc17a5df7c0683109246e55f2ea1459321c30fa543a8c4b35fece1633658dc9325627b8
-
SSDEEP
3072:QPXiK/bKCI5TeZMxRJRldtUMdI6CqscexA:nEVZ8N9RhscEA
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
premium251.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
H?G7iEWK_W0R##2# - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1724-57-0x0000000000090000-0x00000000000C0000-memory.dmp
Files
-
1724-57-0x0000000000090000-0x00000000000C0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ