Extracted

• • Target

    768-67-0x00000000004F0000-0x000000000051E000-memory.dmp

  • Size

    184KB

  • MD5

    12c14d3ba1c45ae4f2977409d9b50d19

  • SHA1

    166f11ef67b7c0bbe166f8d99cd2cf7939f5c03d

  • SHA256

    555da8055f570263fcff48d693b7b7a613e808028f113bf8357637c35e1d6d71

  • SHA512

    d48de841442d41afd56296e417330ce835e6a165b831f45627936d8d8d7876a893c1eec8392a9150bff73ce811dcd935e199ef9d7b96c9e9dce2141581fbbd7b

  • SSDEEP

    3072:kGwnxMkwAIPinTZHUknyB4NHuBND/PNq16dKcbc9FHkNbcfPTZ7Gm:vAIPiTZHUkPOLD/PNq16dKcbcX2bcHT

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2