agenttesla | 7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12

Analysis

Target

SecuriteInfo.com.BackDoor.SpyBotNET.25.6539.4149.dll
Size

643KB
MD5

0ed458621a0e75e9dac09b9cf00b909d
SHA1

02f07b3badc63785cd66b181657322f851d3b0c2
SHA256

7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12
SHA512

2cb0a297922a609ccbebe3bd64ba8aa7560e2440753c0c39da545cb78248050d1bb0b98b92dd9e013ead850a7087882296bb464e7f639e8c5456b0955f9f9ac9

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/996-139-0x000000001B700000-0x000000001B738000-memory.dmp	family_agenttesla

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

regsvr32.exe

description pid process

Token: SeDebugPrivilege 996 regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	996	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.6539.4149.dll
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:996

memory/996-118-0x0000000002BA0000-0x0000000002BB7000-memory.dmp

Filesize
92KB

Download
memory/996-124-0x000000001B740000-0x000000001B742000-memory.dmp

Filesize
8KB

Download
memory/996-125-0x000000001B743000-0x000000001B745000-memory.dmp

Filesize
8KB

Download
memory/996-127-0x000000001B746000-0x000000001B748000-memory.dmp

Filesize
8KB

Download
memory/996-133-0x0000000002D30000-0x0000000002D66000-memory.dmp

Filesize
216KB

Download
memory/996-138-0x000000001B749000-0x000000001B74B000-memory.dmp

Filesize
8KB

Download
memory/996-139-0x000000001B700000-0x000000001B738000-memory.dmp

Filesize
224KB

Download