Behavioral task
behavioral1
Sample
2860-66-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2860-66-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2860-66-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
01e333f425f395f3fed6086b2d0920b1
-
SHA1
bcdd3c9d93d43c37071c2078604912349e7d366d
-
SHA256
1a9968a251c59f4e6239a6239e8007029311b9e97b4ffb7a4eee97c3e9d49575
-
SHA512
f56b45d00fea562e6083cfd13fcd32f9bf00e9c740f94ce65d6664ca95be2f580d8be6af7186be112a47df0eb7433ed13052cb219b37086f492b961e7988134f
-
SSDEEP
3072:T2Ab/nG6XHwF1eBKUXagJLr5VAz9G8ZBzF3GAj:T2OHwezvm9JZ1FH
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.synergetica.com - Port:
587 - Username:
[email protected] - Password:
GoodLuck8#8 - Email To:
[email protected]
Signatures
-
AgentTeslaV4 1 IoCs
resource yara_rule sample AgentTeslaV4 -
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2860-66-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
2860-66-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ