Behavioral task
behavioral1
Sample
2232-7-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2232-7-0x0000000000400000-0x0000000000440000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2232-7-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
2e986e451a95540d82e2f31be49ac1fd
-
SHA1
7e826e027c9990a568e0153c7f1e65ffd014253e
-
SHA256
af2a9ef48c1edbe832f2be78a2e1d992902dc9759f2eca5360ddc291dd84599c
-
SHA512
cfbe509434a9e654e93da87b794d6be070fabc56e5fb4936ddafc530c3175fad1b147bfe264522db2a27205e64d82880d0aa473d7ee683de2af6d93ea733fe5a
-
SSDEEP
3072:MgAlxVZljwWsfjbhnpfzgB0rHkc5blzzUk:MgAlxVZljwWsfjbhZzJrEYzY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pgsu.co.id - Port:
587 - Username:
[email protected] - Password:
Vecls16@Vezs - Email To:
[email protected]
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2232-7-0x0000000000400000-0x0000000000440000-memory.dmp
Files
-
2232-7-0x0000000000400000-0x0000000000440000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ