Extracted

• • Target

    1960-19-0x0000000000400000-0x00000000009F6000-memory.dmp

  • Size

    6.0MB

  • MD5

    d59ff768feb908aa04c9ac69786ff72b

  • SHA1

    f120a7e4a9e12a66241bd0496dd42ac46074c24f

  • SHA256

    4c9874f43f56326d8cefa7b6860c8d5607888f6e32c53c068db4d50a963bde19

  • SHA512

    f742cfb52310f77f97377a4b265473a6f9efe01193ed2cda85833f1b1be3da066d9ff0a5237e2503178b14d4b9648f5f3f208b026bd73298c1b75ef617c0d827

  • SSDEEP

    98304:NeCmyukrzD/gaH2Kc6fyoSd9SrgmzCg3O5oIfHYxDmd+5DX1bFbqirQt3eMD+Xg:NeCmyu+bfTSTw9el/6zjQirQLD

  Score

  10^/10

  agentteslakeyloggerspywarestealerthemidatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2