General

  • Target

    2480-16-0x0000000000400000-0x0000000000442000-memory.dmp

  • Size

    264KB

  • MD5

    1d75b93ad105d79108eeee06a68c496d

  • SHA1

    eec3451ba6d0e0a9240a986786c57d1bf1c3b03f

  • SHA256

    813a15dc515f2d21f7080148cf15d5575d919af98bfadd77d092a34e86029bd7

  • SHA512

    712973bd97ab7d69b895aeca81b874460187d2ee371bdb29f7c93e98796ea2bd9de729b1ec9d7aa5fa40509153f1012c039fec0243158d99d2f5221f38ba6570

  • SSDEEP

    3072:JWSdh95txdHz9D0DN6Mm3UDABss/BS9lFQg5rCnkeMW+:wSdh95txdHzV0DN6MmEURY9lFQ7nO

Score
10/10

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://valvulasthermovalve.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    leosoftking1

Signatures

  • Agenttesla family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2480-16-0x0000000000400000-0x0000000000442000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections