agenttesla | 2992-12-0x0000000000400000-0x0000000000444000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2992-12-0x0000000000400000-0x0000000000444000-memory.dmp
Size

272KB
MD5

65c4b697cd23dfed19c67c241766a5cc
SHA1

fb2a7e8e9d9aebc8188b160ef66229ac057e860e
SHA256

aa320d1de9f84dbae78c4fe807473fd2c2b0dd6174f17ca37c68f60e697f7abb
SHA512

dfa764273539db8b9b20d09b9ed64868d606f54ee3ab93212e3af7600bd5091dfbbdf084a0d4786e9096137c9eb47573f66e370d19739ca15108cc3a454e9b08
SSDEEP

3072:ySnEe+5ZilUSZ5Cz/ST68aGQ5WYk2Rf91y+B/282:ySnWuUkCz/ST68rQ5a2Rf91yY28

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2992-12-0x0000000000400000-0x0000000000444000-memory.dmp

Files

2992-12-0x0000000000400000-0x0000000000444000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ