General
-
Target
2528-132-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
94f4b3a03e7dca9dbf23bf5f5e868edb
-
SHA1
9fe8ebc2318a57c6b47158380e228c98284cb3fa
-
SHA256
12133a85971721bf8fc0cf7ff6ef3ca4b45f5aae95087aff2d34a82d59870dee
-
SHA512
c641c9ce3eb07e531b08b6dae3cee398b12d4e53a8e1440175e2de0149ca1f2b13c39e7c72567908ce7fb5891ca2c6cc0063da5ab1093191cd61e4df980cfd5d
-
SSDEEP
3072:bToZyFOY5xsrUp3yirL1fml1nL9Sx6skAp5ovhv:cu7srUp37FfepLMX7K
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.grad-vodice.hr - Port:
587 - Username:
[email protected] - Password:
pKs9zy8Nn1 - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2528-132-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
2528-132-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ