agenttesla | 668-64-0x0000000000400000-0x0000000000430000-memory[.]dmp | Triage

Sharing

General

Target

668-64-0x0000000000400000-0x0000000000430000-memory.dmp
Size

192KB
MD5

400310508a2f27b14e5a6982ec401be9
SHA1

324603fadb61b0c06881299985ad717decd6c4c8
SHA256

1601d7e0b5aa4fc9a8b748b3194b1d7957d1d88896d464a805c38a838bd83d78
SHA512

4c564992d15565cf020be94bf3a625dc341b5430ab2fc20f8be41dda42d9b26d75c561921a90290f4169cdad63e167085b382afcaff256f533e8c89a37303a1c
SSDEEP

3072:6VLDg6DaOyeeVZ6x0ClKK2Ll7RD6dxtVUUNzlosAK3XbEqx:6VdaOyew5C+lofyUx3Lj

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.nssltalia.com
Port:
587
Username:
[email protected]
Password:
jSPKfh#5
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
668-64-0x0000000000400000-0x0000000000430000-memory.dmp

Files

668-64-0x0000000000400000-0x0000000000430000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ