Overview

overview

10

Static

static

10

1532-17-0x...ry.exe

windows7-x64

1532-17-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1532-17-0x0000000000400000-0x0000000000440000-memory.dmp

  • Size

    256KB

  • MD5

    3b978dcecd2479cef864d3be67d1c26a

  • SHA1

    a5ffe13a52a87c481481b81a5232a840459b64da

  • SHA256

    9a9f854d4eb78a11d349ab9a939abecab9dad7797b5dadb0dfa59ca65cd60ee9

  • SHA512

    83268e1a8fbdee0aecba1bfa216d9fa5066b94e087309318744745c3b3f324d60dd118fa2121d020a390fcdcecfeace5f234723f42168e52acb218a2813eb6e7

  • SSDEEP

    3072:qOw/k7XjnbP29wMYISDyFowVpNU5lA5Iazt:vws7Xjnbu9zYISDLwVpNn5fz

Score
10/10
agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.normagroup.com.tr
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ab+LNvim5PAo

Signatures

  • Agenttesla family
    agenttesla
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1532-17-0x0000000000400000-0x0000000000440000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections