Behavioral task
behavioral1
Sample
2644-18-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2644-18-0x0000000000400000-0x0000000000442000-memory.exe
Resource
win10v2004-20240508-en
General
-
Target
2644-18-0x0000000000400000-0x0000000000442000-memory.dmp
-
Size
264KB
-
MD5
cd5a01cd35b363c8f6baa5c0669d8acf
-
SHA1
f674b757451fdbc1a49f0c3670e1bddde8e6721c
-
SHA256
4258cadf29c641790bdec66e21072eef02fc7055b81cc45a4701b788e45a37ae
-
SHA512
f564970d6079f27afa649eab3b80daeb0b3d968dbbe76699ad6e178d62890ed2ef17b6cb43ce01582380dbe4551dedb192b1cde0074790012583ba958dd91832
-
SSDEEP
3072:ToHXPfnIPGO10mhPJAWLSwxhmUD+cHkFe05pChDiAY:EHXPfnIPhPGSS6hma+C/fh+
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.midhcodistribuciones.com - Port:
21 - Username:
[email protected] - Password:
,A7}+JV4KExQ
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2644-18-0x0000000000400000-0x0000000000442000-memory.dmp
Files
-
2644-18-0x0000000000400000-0x0000000000442000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 233KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ