Overview

overview

10

Static

static

10

1880-46-0x...ry.exe

windows7-x64

1880-46-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1880-46-0x000000006F190000-0x00000000701F2000-memory.dmp

  • Size

    16.4MB

  • MD5

    7a385d812dbf270728654857dea8173c

  • SHA1

    081a7c9eb3cc1eb95879ff0383473b530c1c44ba

  • SHA256

    2c926b965f9b26b6d5ec36d2d21d1f0836ec0016398f393f92f6e37742735e6e

  • SHA512

    46a1f84b78d616b06242b796945b56eda6471dc55894eb88ec0e9a244e004d022b206c6f511c53ef904aa216dc54f92a0cad659265464ee241ba041eb103da45

  • SSDEEP

    3072:Tu7Xjnbe9Q43OAL+VbQ8bM+6Wv5u1jVqf:67Xjnbe9Q43OAL+V1bMjWAjc

Score
10/10
agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.cefin.bg
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    #UuXy?6cIbL+

Signatures

  • Agenttesla family
    agenttesla
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1880-46-0x000000006F190000-0x00000000701F2000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections