agenttesla | 2064-1061-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

2064-1061-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

fd008498ef3f93d6af177507d7b34d9b
SHA1

fa3e421af2a9a23c74a72a1639c8731cd439eae1
SHA256

d5ca2a8b3a359436e3c5fc322c98a9d9b148cf058985c4ad7d37d5291dc802b1
SHA512

c075891d09b50e1af6d35b737bed3d31828b7f94c9e9f63053cb55a99ca3eda9fb68ecf375ef30ebf0ed316c1ea45b7488cca204cab6016fcbe1fd3f6c6a56e0
SSDEEP

3072:rIksSP9vvV4XXJluKV52qGTMb9007csXAjR6EQ:rIksSxvVMXJH9GTMW07cso6

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.asiaparadisehotel.com
Port:
587
Username:
[email protected]
Password:
y.tYfN)aoq4w
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2064-1061-0x0000000000400000-0x0000000000442000-memory.dmp

Files

2064-1061-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ