agenttesla | 2888-33-0x0000000000340000-0x00000000013A2000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2888-33-0x0000000000340000-0x00000000013A2000-memory.dmp
Size

16.4MB
MD5

20674464320d6916902efd1a98593911
SHA1

8d239573019b95e9fad568c2d0f7cff150eec0b3
SHA256

d081e2c0e44252e46a94ea1410ccb3bcf9ecfbd30afa8da22cc6b4b82c7b33fe
SHA512

17a44dbb74cc5c994589154cba4478bec159fec388006acb74aad0160405d37e9f4352c18e67710b733a777b4f95b7190e19c8b539a1a0c26b8b2f4debfedf72
SSDEEP

3072:ors+6Wa+HvJ0JyyyyyyyyyyyyyyyyyyyyyLyyyyyyyyyyyy9yyyyXT1R0orHZz56:oQ+6Wa+HvJLEEHZbMV

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sslout.de
Port:
587
Username:
[email protected]
Password:
dataset123
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2888-33-0x0000000000340000-0x00000000013A2000-memory.dmp

Files

2888-33-0x0000000000340000-0x00000000013A2000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ