Extracted

• • Target

    2892-9-0x0000000004290000-0x00000000042D2000-memory.dmp

  • Size

    264KB

  • MD5

    8ffdc20439e33f60d1509037fcc48a27

  • SHA1

    25237e7b87b651d547474a353c269b341722946e

  • SHA256

    30115c30a2f39b91f13461516dba0b5f7e1715a05a4273486dc82f96b6b131a9

  • SHA512

    473d04b8a577a255d56c39f3559bbdaeaf9e07412f91e0d5f35bb524f173aa15e474447d07a6052689b36ce2f859e25c4e5d8fc020125301c3d499e99d866f8c

  • SSDEEP

    3072:R0DH3jH7HY9NZxsY+DvDigNaMYW83fv9B5PxwBot5:63jH7HY9NZMLOka5x3fv99wa

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2