agenttesla | 2464-11-0x0000000000090000-0x00000000000C0000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2464-11-0x0000000000090000-0x00000000000C0000-memory.dmp
Size

192KB
MD5

d9528081d7b3effbbfee26e8c8aea7e9
SHA1

0d3b649898bf221205a59a59883c45eb84cb7f2d
SHA256

5f92b634afaf32debec6ac83060dc32980e0a2c013dfb343fe9f4584a50cff49
SHA512

662825f3ef5eed3ec29bb034840d36e675ce4eb3086fcc523fae3966818a237b47932c75ff42f21ca65668816e9d70db0868089c172a3ea307de72e0a6965a7d
SSDEEP

3072:cSaas1lAgldsq0Ypsm3Cpc7w8N4jb00s1uMr7NB7:k1lDdsqRpZqoNgb0tF7

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.worlorderbillions.top
Port:
587
Username:
[email protected]
Password:
7ace90qwerty
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2464-11-0x0000000000090000-0x00000000000C0000-memory.dmp

Files

2464-11-0x0000000000090000-0x00000000000C0000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ