Extracted

• • Target

    1640-66-0x0000000000640000-0x000000000066E000-memory.dmp

  • Size

    184KB

  • MD5

    48ba03d1e13710e00d3dacf7281a1bc7

  • SHA1

    7831343f843f2b1df401efb00e74522b0c967d49

  • SHA256

    e0b5bc79fe3d74d5a0c5eed537237011050b7938c64f76ab8c1d16aebb49ba8f

  • SHA512

    ccc6ef6d7d2965658e3e6768fe98b10253fefaffc499028002aba6c818cd2373fabd891f1730585c3efd357b2450a1b9910ebb8ec52addecab46aaa3fb756aa5

  • SSDEEP

    3072:HObc7X3kFXKSambUzo/udoXTDvbpV1WJ57u9CXKB9eO/0kn7CbmB:MO3kVKr0Uzo/ecL1Au9C6B9eO/0EGb

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2