agenttesla | 3028-10-0x0000000000090000-0x00000000000D4000-memory[.]dmp

General

Target
3028-10-0x0000000000090000-0x00000000000D4000-memory.dmp
Size 272KB
Sample240521-ecfmasgd88
SHA256 3959f6ef0b4982917582595d97ce7f09f92eb3d3bbc40af37cb94bb5e2c648a1
MD5 f28bbe570c680c434cabc8f6c580bc98
SHA1 acba8aa67b3d1598adb623d83a4b3beae3b396f0
SHA512 8d1d15a7cf896c9481ccdc2aa7701ac7c2ec44e7ba278fcda16f6f8e69542ae5d0f75795f4e27238652c9dfede912fc3b8c349c9e0acc902d1000885c8a899bc
SSDEEP 3072:61a+oxTjLrDoFzTBITRfPdpcG4G9mS+6mCfatPu+5EVtZDDgoX:61a7TjLrDazTBIld+lC22htl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.avtorska.com.mk
Port
587
Username
[email protected]
Password
avtorska2014@
Email to
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3028-10-0x0000000000090000-0x00000000000D4000-memory.dmp

File Explorer

3028-10-0x0000000000090000-0x00000000000D4000-memory.dmp

.exe 272KB

3028-10-0x0000000000090000-0x00000000000D4000-memory.dmp

SHA256 3959f6ef0b4982917582595d97ce7f09f92eb3d3bbc40af37cb94bb5e2c648a1
MD5 f28bbe570c680c434cabc8f6c580bc98
SHA1 acba8aa67b3d1598adb623d83a4b3beae3b396f0
SHA512 8d1d15a7cf896c9481ccdc2aa7701ac7c2ec44e7ba278fcda16f6f8e69542ae5d0f75795f4e27238652c9dfede912fc3b8c349c9e0acc902d1000885c8a899bc
SSDEEP 3072:61a+oxTjLrDoFzTBITRfPdpcG4G9mS+6mCfatPu+5EVtZDDgoX:61a7TjLrDazTBIld+lC22htl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

258078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing