Extracted

• • Target

    2860-9-0x00000000008F0000-0x0000000000932000-memory.dmp

  • Size

    264KB

  • MD5

    8649cc7c770263b1d3572e104286f107

  • SHA1

    9f324203089745cd12357450d3d6833eab55fa95

  • SHA256

    5870b8fb792701e9deebf9c9bb386f67adb57e9529c41e117adce3a9d724ea54

  • SHA512

    ffa8bfe1c4f005cb111fbcb2e262a3777a2e6cc83afbfbcffa68c5cbc4e4146b60f0476cfcaf6e12c6ed042804b808204bc5ea6231cd97a938b51649464cbf63

  • SSDEEP

    3072:f726qSCKzkEZP/wjrvIyPqX+XorW5xdJpWpi:S6qSCKzkzPgaM+XorMJ0

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2