Behavioral task
behavioral1
Sample
2564-12-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2564-12-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20240508-en
General
-
Target
2564-12-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
5f74b80307eaae7e6fa3e06cfbe6c58c
-
SHA1
973f141c155d7a80d15179b5b6710b12629b5a12
-
SHA256
4f3c643da93f78bb8b0c305d417dede0761dfab47454cf6610d8546424d4e33b
-
SHA512
8d911b2e1e00c4a9fbe256957cffdb67d2e0d7d58c349d5d413129da045b6c8ad3abe102af6869bc702be4d0af3507bc624f1600308143cfc6163e197988f269
-
SSDEEP
3072:EbYCeMoUAMw0HXSI5rRWZmImxHGly5ugDD15:bCeMoUAMw0HXSIHWZmI2HGlCDx
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://eu-west-1.sftpcloud.io - Port:
21 - Username:
dc2d3038d5c743319b4d84cc320c4fad - Password:
xmFBI1ctaq8b1qv5SWZ3AOzpG1Yb6y2K
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2564-12-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2564-12-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 231KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ