agenttesla | 484-13-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

484-13-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

632e7c62b641df43331c82f0cda35470
SHA1

2461d16f63de42756db0ecb59d6bccc0d5f46259
SHA256

2de904bdb4ed1f472e741499d48e6b8efb4891b7972b38fb2d773ebc2afcf45e
SHA512

1a86e0ffaa9761345497d024b200d545a9d3ceb0c64ea3f4ac7d57b6d99aa49d2177acbd0df09b492e7be7b2a9eb52cc0d8b408c132d4ee4706e224f5adc4017
SSDEEP

3072:PR0DZ3zfQXTkSbXyl45LF0FzkCrJ+sHOB:WZUjkSb845/Q/HM

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
uikstcmljdzhturh
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
484-13-0x0000000000400000-0x0000000000442000-memory.dmp

Files

484-13-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ