Behavioral task
behavioral1
Sample
2388-67-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2388-67-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2388-67-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
a4835feb311b2b112cf3786980bd061e
-
SHA1
d5936a7b78f2f95dc74d7e6ca542b33ac816d9bd
-
SHA256
fe3962e5e79acbb3ca2d9c819d7d91b15bffe549b34b88cc018677d359ffcb99
-
SHA512
7eeed7e72d3698709c94c3bbdae0fcec06e327950e9bc023ed6b7bf76129264d021f655b711ab34216ed17b1b763486fa2319342dab28f7aef109ce542d099c8
-
SSDEEP
6144:4DthOzj8xzKQCmwqBbvBhQ6oubr+SxlGxA:4JkUQmwqZvDJbrTI
Malware Config
Signatures
-
Agenttesla family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2388-67-0x0000000000400000-0x0000000000444000-memory.dmp
Files
-
2388-67-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 144KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 119KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE