agenttesla | bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd

General

Target

bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe
Size

757KB
MD5

6f9419d0156908698670142676d3606d
SHA1

d529a9f62f07656c4cd7b3049f12bfe27bebf66e
SHA256

bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd
SHA512

55cabbb1e9257356ba5be9ce653206f2bfa009c3f13e082455be91cbf9f30640d49163f5924e9a1efa530ab335188c98f7bb89b4b44349292ffeae19c1bfbb78

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4144-141-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe
4144	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92
PID 4596 wrote to memory of 4144	4596	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	92

memory/4144-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4144-142-0x0000000006230000-0x0000000006296000-memory.dmp

Filesize
408KB

Download
memory/4596-134-0x00000000002D0000-0x0000000000394000-memory.dmp

Filesize
784KB

Download
memory/4596-135-0x0000000009780000-0x0000000009D24000-memory.dmp

Filesize
5.6MB

Download
memory/4596-136-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/4596-137-0x0000000004E10000-0x0000000004E1A000-memory.dmp

Filesize
40KB

Download
memory/4596-138-0x0000000008850000-0x0000000008D7C000-memory.dmp

Filesize
5.2MB

Download
memory/4596-139-0x0000000000C80000-0x0000000000D1C000-memory.dmp

Filesize
624KB

Download