agenttesla | 736-8-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

736-8-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

f1b3026e63773afb69db9ca56ea74954
SHA1

7512dfb786841cc6e6c1f31642306294385c5da3
SHA256

5853910c775f8044fca72ec6563302d6c655ef5a47ecd22b4edf9a7c6238add7
SHA512

f7b3a9de4098729f1586d69754c9bda00ee1a4d7690eb40484d5e6aa829ce31dea8b848f2f1d0ea7730315a7bf42c4266b6314a7c98f0c462456d05a0f86bec1
SSDEEP

1536:HogGPWW96p3SOC/pr9QPUG1j+WyK1ckFEDVG4QxxPHGJfbkr/iG5uMIm+pyXqKBM:IgG+W9y3SOC/nQ8MgK1WG3IDSBtIsQ

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.amtechprinting.com
Port:
587
Username:
[email protected]
Password:
eGP.EBaE63f*
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
736-8-0x0000000000400000-0x0000000000442000-memory.dmp

Files

736-8-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ