agenttesla | 1956-72-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1956-72-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

1edac5d243b9fd64025a3d214f8be5cd
SHA1

b923e69595d4715737a0b86d93d77446c542c055
SHA256

ba0cdf655335bc1b31ca1e252f19412a8fea1efdf5a91af1cf0ee7fc13323591
SHA512

e6fe4f4c3b8e500af6883146ca1f01f9d47bff382cfaddf3eaa3e6d19d9d853eeb7e24cbec26ae4a6569745372fac8cf31667d272dd9522f0713f8c58cdc20ca
SSDEEP

3072:WD7XnDZ49m1P8qB3zrqa899a1Rk+x/qmC3kkbg2y:WFvP8kvqx4/qmyf82

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.keefort.com.ec
Port:
587
Username:
[email protected]
Password:
u=Wa6eChU3nj
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1956-72-0x0000000000400000-0x0000000000430000-memory.dmp

Files

1956-72-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ