agenttesla | 4772-937-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

General

Target

4772-937-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

589dad31ed57e12a88ea321424b56e15
SHA1

018814156353214bfdde41325cf4f662d2fbca28
SHA256

a2bef0686a24e410a114870a0c6a869429d4e51c6a6bad799ca8b65df956bec0
SHA512

cf8fc543c2eb66f1bb1e57a666e51e2754e89351b0fcda6e2fd6e70ef89c2f031cf929bc966dcf06ed356a74cf89de589c2b713b66783071339960e5352db1f2
SSDEEP

3072:uQf0QcQkRH6YgOuUxt4xLcnZ+ZWv7wZSuT5LMnaSHn:Nf0QcQkRH6YgOuUxt46Z+MzwZVin9H

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.jaazgroup.com
Port:
587
Username:
[email protected]
Password:
cincin/123
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4772-937-0x0000000000400000-0x0000000000442000-memory.dmp

Files

4772-937-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ