agenttesla | 4388-141-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4388-141-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

a72a4efa02d35922d272956d714a4fad
SHA1

de85483bbc02b0abfdd592132b3b7d8133f9ff4f
SHA256

423281f612b537aa8298196f3ce6ff7d1f745f905d5d0b4bd47986eb64ae37db
SHA512

b191fb3f7ab678df7b9eada3aaf45bf298518252d64f3966960d3f756d2c614abc2ed3277b70c1b499d60a232dab1723b61cf8c79a348198ee2f267594b1f39b
SSDEEP

3072:6ls2ek5cOGl4lOX5TE4COBfw81XosCG2+zQfgjTsd4nE27EC4oh3:xk5cn6lOX5TDCIw8pCG2twTqC4

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
ubduipymcemperot
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4388-141-0x0000000000400000-0x0000000000430000-memory.dmp

Files

4388-141-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ