agenttesla | 292-76-0x0000000000520000-0x0000000001582000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

292-76-0x0000000000520000-0x0000000001582000-memory.dmp
Size

16.4MB
MD5

a283b652f7c589a6e667a61352b0bf1d
SHA1

133c46368894e3b2a8a97701aafa4c26a8b92742
SHA256

a0d5b7af7ec9d41f27b912851c4097ee11a9af5374b76d203c89c5b7dd9f9247
SHA512

9e3a3689b4d3a7ac074d97f5ce42412f18463fde281361ebe881bd118a54e0b7759943f81c92ceff32e8244e9ee54803d413a9e8062f9b20e967aaddbf3871a2
SSDEEP

3072:lFR5h5BBhz5YiCcuAAJTtFp0mKpS5QuBjuPH:lFR5h5BBt69c4Vtb0mW+B6

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.myhydropowered.com
Port:
587
Username:
[email protected]
Password:
q5NHtWyc5WKhunX
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
292-76-0x0000000000520000-0x0000000001582000-memory.dmp

Files

292-76-0x0000000000520000-0x0000000001582000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ