Behavioral task
behavioral1
Sample
2256-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2256-9-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
2256-9-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
e3b81338dcd861129114bf718e2d180a
-
SHA1
c8e9e67c0a8f4830567a3126023061ac27e41b9d
-
SHA256
dbfbc333ecd37eb5eb47e86c107b93bd64331110098e7a3e4239223bb8ae2a0f
-
SHA512
4fc202b7ff85b8a803f6e3fa761a8cf1ba5c1fe2e6a03780ac8f2b310a2bb87c13b61feae26225d37e517dacf13ffd6e84950bc5178204af6edad37836b910d6
-
SSDEEP
1536:IByIBmqzL/Zlx1J5BOLlTUiIcbICbMFMTmt+e8JNafhEW98fb25Lq7sXgi8o22/e:I1T7Zlx1JnOdfbaSTmBJ9Ab25uogi8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.fasmacopy.gr - Port:
587 - Username:
[email protected] - Password:
Fam28sjd - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2256-9-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2256-9-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ