Behavioral task
behavioral1
Sample
4620-7-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4620-7-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
4620-7-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
1efaf1ffc4d3c8f9bb57f1d2b469f205
-
SHA1
f0218e2c5e0cd79d7606935daa2baedab8333ab6
-
SHA256
e37d8ae6992f2550e68c15eece45f3be64ce048b089a10ecccac9fa8a6f99cf9
-
SHA512
519d69b823876ee600801f83d1cf19e28f77d8cf54a7662747e9978fd397640d15c2b8aeeb6bebaa6e4664d842f3ac027d67ad52d21b9059f134d709525267c9
-
SSDEEP
3072:hvwuIo6WWMUDVNvZ3/qBbIq5PaeKU9XfTamL:Bw4HWMcn3/qBbIEa69Xfr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.giroplastic.com.br - Port:
587 - Username:
[email protected] - Password:
#no2@tec - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4620-7-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
4620-7-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ