agenttesla | 1368-35-0x00000000079B0000-0x00000000079F2000-memory[.]dmp | Triage

Sharing

General

Target

1368-35-0x00000000079B0000-0x00000000079F2000-memory.dmp
Size

264KB
MD5

122ba5e370e399597465b568eae1c4ba
SHA1

4f29fbd435f188ba7d0629dc796364b6bc8ccc72
SHA256

8576afb49844d56687ef5da5a04ab41b6a678c94cf89fd0891f6c9284360aee4
SHA512

3b77acbc6e0da5c84033ff6f82f42dc8e2d3fc6dfb9a4ad6346ac7ec1c6bc977d9c2521c83abdcdd99578df6badbc16f693e7a2d2ce3a7fb93261fa04789b4de
SSDEEP

6144:tSgPZesxT0kkE0PVgW0bxcA0grGhH+5Id:XPZesxT0kkE0PVgt2grGh

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.clslk.com
Port:
587
Username:
[email protected]
Password:
NUZRATHinam1978
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1368-35-0x00000000079B0000-0x00000000079F2000-memory.dmp

Files

1368-35-0x00000000079B0000-0x00000000079F2000-memory.dmp
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ