agenttesla | 1016-60-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1016-60-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

13d1bb88d166e0dba216f5863592d5a3
SHA1

d72405ec47a570da28aee39e61809ccfe20fdf14
SHA256

f1a35391dde37dc51d77cce7b219b34b6dc907b33dd6a5c3e9fe92870399b4ff
SHA512

53df202807e31b8d5f991312e6c055ab95f4ff31676714f9359e7c69c4534577b17ba7de05ea5c8e9fc7128be541f7f2f58306ef7ed6adda0f339a64c7461711
SSDEEP

3072:Ssdpz5AYhXs9sudm6gpFR6mOzkYy0gzoea2fdlE21qZV:nxhXspdm6gpFR6tzry0gLlrq

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
server1.sqsendy.shop
Port:
587
Username:
[email protected]
Password:
a]pX7AXvUf=6
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1016-60-0x0000000000400000-0x0000000000430000-memory.dmp

Files

1016-60-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ