agenttesla | 2b47982775d5a2c6ada5d6be317189756c51c91ae77490e02f4f999bbbe24d49

Analysis

Target
35f17287a16103dba111b941dd430c98.exe
Size 1.4MB
Sample201109-bf82ttmc4s
SHA256 2b47982775d5a2c6ada5d6be317189756c51c91ae77490e02f4f999bbbe24d49
MD5 35f17287a16103dba111b941dd430c98
SHA1 d5cc488af7530060c0407fed22919eb8fa685fad
SHA512 01283bc3be0266cdbd8523fa55d93bb277167507179c32743991b58935f427297c61cc332f9875777fe5cf74621ced17847e30c9416363b263901ed56387e09e
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3460-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/3460-1-0x000000000044C9AE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 3460	1812	35f17287a16103dba111b941dd430c98.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	MSBuild.exe
3460	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3460	1812	35f17287a16103dba111b941dd430c98.exe	75
PID 1812 wrote to memory of 3460	1812	35f17287a16103dba111b941dd430c98.exe	75
PID 1812 wrote to memory of 3460	1812	35f17287a16103dba111b941dd430c98.exe	75
PID 1812 wrote to memory of 3460	1812	35f17287a16103dba111b941dd430c98.exe	75
PID 1812 wrote to memory of 3460	1812	35f17287a16103dba111b941dd430c98.exe	75
PID 3460 wrote to memory of 3944	3460	MSBuild.exe	79
PID 3460 wrote to memory of 3944	3460	MSBuild.exe	79
PID 3460 wrote to memory of 3944	3460	MSBuild.exe	79

memory/3460-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download