Extracted

• • Target

    1036-11-0x0000000006AA0000-0x0000000006AE2000-memory.dmp

  • Size

    264KB

  • MD5

    b472ace8481e0f4f18be9c8d2836faae

  • SHA1

    4776ddf340c51f5e46d24599679b473424669d4b

  • SHA256

    e7e40f087ab101345dc6e420be57371c0bb23001edd0f6b7abfca53de5fed58f

  • SHA512

    d3f7feed21597ef58aedfb6e14d4f780c2b2babca0780150ab231fc2625c1257d12856c244a30a65756c9eaaae8f69a7836ac8021368c55f39888379e4ed5827

  • SSDEEP

    1536:ylR/Dn+tuzIhly64XU5Dzrqwrr1wRDh+GkJLCL9RdSdNm4606Bskcp1BVYmYCb3r:O/TKPsQXrRbLC5mdNmf06B4VYEAzY

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2