agenttesla | 2588-17-0x0000000000400000-0x0000000000440000-memory[.]dmp | Triage

Sharing

General

Target

2588-17-0x0000000000400000-0x0000000000440000-memory.dmp
Size

256KB
MD5

18de1a368104c6c05b8ddb766cfdd4d0
SHA1

e7638673ac00baf157ee7ba22f3831af37ec2d3b
SHA256

612f1b162776ddda751c6e1593557174e37de0ae1d4c88a1a486609549b38c98
SHA512

ce136ca30175a91917f9c42c33e76e2f50bd393258f1f46e89c8dca4d2078bbdc934a152acdd9175d35949cafc0d0d50d68160fbb053182748d1649b6ceae2ee
SSDEEP

3072:4beCmyuig3qZcP9b1F7USGAblcvWX5sqHf/q:4beCmyuiYqZcP9b1FoSGAblcunH6

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hhipune.com
Port:
587
Username:
[email protected]
Password:
c@c1r2e3
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2588-17-0x0000000000400000-0x0000000000440000-memory.dmp

Files

2588-17-0x0000000000400000-0x0000000000440000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ