Overview

overview

10

Static

static

10

2824-13-0x...ry.exe

windows7-x64

1

2824-13-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2824-13-0x0000000000400000-0x0000000000440000-memory.dmp

  • Size

    256KB

  • MD5

    8e4b918440365712369125c2cbc558cb

  • SHA1

    6d75ca5ac0c61cd24875f50d474f596ec14e30dc

  • SHA256

    66184ce819a3fc956371a0217be46acb979dd1a71e4b0a4aa2d03e1d802901bd

  • SHA512

    01faf82adf5220fecf24891a0c9ecb4bed7049411d8877f8365bf9db59a1f0749e6442fa2664ddc9db1b6099bee695d7a835c1b077e1bea166aa8e1ce6c17a67

  • SSDEEP

    3072:mc1LZKj8AUgsXPXhKS+RP+K03sANjeHDR/cEGr65K/pU5K:p1LZKj8AUgso/P+73sSjaD9clr/UM

Score
10/10
agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.icemp.eu
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    bVkMH6R.pfF~NN@ossy$W!_pz[bh!9l(MU%UtX9L^W}vO=mn*g*;]}]

Signatures

  • Agenttesla family
    agenttesla
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2824-13-0x0000000000400000-0x0000000000440000-memory.dmp
    .exe windows:4 windows x86


    Headers

    Sections