agenttesla | 2224-12-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

2224-12-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

449993ff1bccc7e2d964b1f3f9b6caa5
SHA1

963d650776efaec532be5b4d9e6d176c844f9f84
SHA256

9d10dea0da60d6c8a089eb941b0747dce5908bc0d9a4a07e62c0f4f29c7b059c
SHA512

01200b6494380fe57c6e0ddfaabb6b1604adce37bc8491e926a7777be698e26833e0d04c10dba312d17a9bd8dcb319917cdc74e048beaea03df757612d9b8917
SSDEEP

3072:PX08oWeemmaJIzr957+gKxnrAPOkNy/u5KAPf+j:PZoWeemmaOzrf+gKxn8POkY/yPW

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.zoho.com
Port:
587
Username:
[email protected]
Password:
=== s h a h naw az #2 7 5 5
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2224-12-0x0000000000400000-0x0000000000442000-memory.dmp

Files

2224-12-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ