agenttesla | 2688-13-0x0000000000090000-0x00000000000D2000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2688-13-0x0000000000090000-0x00000000000D2000-memory.dmp
Size

264KB
MD5

bb9c4c99391937643a96374a29a249ed
SHA1

2cdb7641f0a08447e0d994319c8186c895bdcca7
SHA256

cc74bf5970e1d1e6d226be7183e8a64102cd30c6e022a3193c56711394218721
SHA512

9a2bb3e4978840421e68e106d22b7c003a999d7e646aa9e844b6f42275fa9a90c9b0c13527daccca35fd930cfc471a3a1fcc9755c649d36d00cdd77967127471
SSDEEP

3072:pnF9N3fmexLHce9K5/st/uwLNVGPhPdD5b6xtX4vlP1:NF9N3fmexL8t0t/uachPdcxto

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.enropalsrl.com
Port:
587
Username:
[email protected]
Password:
c@e124356.
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2688-13-0x0000000000090000-0x00000000000D2000-memory.dmp

Files

2688-13-0x0000000000090000-0x00000000000D2000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ