Behavioral task
behavioral1
Sample
3032-61-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3032-61-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
3032-61-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
52d9f5f662b3aaea248ed2b4d6e80c71
-
SHA1
dec037d88b3cec220d6d9c72c74ebb11bfa8fd91
-
SHA256
1e5ecc2ac88402ca842b24d9329766d851c58a4127256c17b46f286891e4fbda
-
SHA512
3b1ddc34484247fdd17623e1e4874b9c11854d110214d46abaaac6031877310a1d5fcfbabeb7913bca036a6451da7d2ecb851a2203dcedeafa6afaf2982bb4a1
-
SSDEEP
1536:VqaUbFPNPawaVukepmmt9m0CLjakHuL3M22Nfhk34rrL564TtX3vtknaAlHrorcq:Ia4FP075omvpfmarL5ftXVkvlS00y+
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bulktz.com.ng - Port:
587 - Username:
[email protected] - Password:
kizzmum300.1234//EYEYm - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3032-61-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
3032-61-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ