agenttesla | 4208-12-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

4208-12-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

67c3cf644df45a9b9a9c9543f9d3b1d8
SHA1

3988f903871ce285277e5cbbf9dc7ef2fd71659c
SHA256

a7ad141d7ebe8e726b517c2bbf5f5b3aa25ac76c0759957d90b5f2bfa94a722d
SHA512

4c75451b42535c074038590aa86068193603f2e718e99a4f2a91de8b0701fd37191fcb45e6276c5daec7a6493cefea6c7f280431a2aaca4efe024d307e3bb220
SSDEEP

3072:cA48qS6SeI1GXAc3ui2j5GIl4ZytKabOJJz5lvkA+gj:cP8qS6SeI1GwQuvF9l4eKabOHPkv

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flecon.com.sg
Port:
587
Username:
[email protected]
Password:
8CJN6A87XUIU
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4208-12-0x0000000000400000-0x0000000000442000-memory.dmp

Files

4208-12-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ