Behavioral task
behavioral1
Sample
2496-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2496-11-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2496-11-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
6084c855e01e537d533ae123d35aebc5
-
SHA1
658c8ff59830de9251d68faacd145a2d26a86e9e
-
SHA256
7a300d5fcfc613d28361ed6348b952f2e4a8749041c7551cc1aa07359a669c09
-
SHA512
15e9a2c02cc0733c79f54b146a9f6ed3724d8345977ea0313359977bdff2491aadc2a60559834565436e7b7bc9fde7ff19a659a32db2399e27dc273af4b90d30
-
SSDEEP
3072:SI+7mVCYMcVTx886GawIyJbUOWbvhypDVTRJpchkL0eEGT:S0RMcn83WdJbUtbZk/JeKx
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
28#75@ts76&&R!!@ - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2496-11-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2496-11-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ