agenttesla | 5116-24-0x0000000000400000-0x0000000000442000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5116-24-0x0000000000400000-0x0000000000442000-memory.dmp
Size

264KB
MD5

88d4bd5fe4eaf46a57a08692f4c7b524
SHA1

d2f3d3456d7ca87d7445911cd73c7ee8cae86efa
SHA256

380b1734f74bec247acef5e30c5ef1396cbc107a40570776857cb7805e212517
SHA512

6fcf80abed228fde03874aa6cb39b7d0992760799a5fa97ba39b1949b8ca0d93e2304b694472128f0d679c5668132e67df62d120441e9d2ff5ea2073a863fae4
SSDEEP

3072:Dofd7c3IGf7fzva4rFUZzUbgtkCVh3u5YV5HkW/SXr/p:DWcbf7fzv1u0QL+5YUWq

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kingcocojava.com
Port:
587
Username:
[email protected]
Password:
mktsub
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5116-24-0x0000000000400000-0x0000000000442000-memory.dmp

Files

5116-24-0x0000000000400000-0x0000000000442000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ