Behavioral task
behavioral1
Sample
3988-54-0x0000000000E00000-0x0000000002054000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3988-54-0x0000000000E00000-0x0000000002054000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
3988-54-0x0000000000E00000-0x0000000002054000-memory.dmp
-
Size
18.3MB
-
MD5
3cfe5751fd859fc9c215e33a45ca822e
-
SHA1
affce10c0c010c5419901f44a3c85bda3e079605
-
SHA256
4fd410a94e2244117c735a030d224231280cdd01a948f84eacd44393ff5b6273
-
SHA512
027111b24ba0196c7a31df788c9eaa55d6180b387d31455b7f41718bf522c991af4b5c64b82d8fb0514e033311794a188d75bf1f1637115abb8f829adb899e75
-
SSDEEP
6144:ltZdRtsU6URxvhCkp0POxHzi0wZeERgM:ltZdRtblRxvhC3Ot2RsE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.scootero.cl - Port:
587 - Username:
[email protected] - Password:
Dangote1235$ - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3988-54-0x0000000000E00000-0x0000000002054000-memory.dmp
Files
-
3988-54-0x0000000000E00000-0x0000000002054000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ