agenttesla | 8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe

General

Target

8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe
Size

903KB
MD5

36d61c953931c88be3e6dcdc1c31ccbd
SHA1

a10467d4baabe41bb977f7ae67789c415900f07e
SHA256

8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe
SHA512

7d348e6f6e82d90a22747e05a9f01de7f25b93340b00d823058b3130ff34aada0a0c98890ee4be6d5ad7290c6636e84134f9b5037d245957fcd3558e61ea9650

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2980-131-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2980	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe
2980	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85
PID 2080 wrote to memory of 2980	2080	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	85

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe.log

Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/2080-124-0x0000000000860000-0x0000000000948000-memory.dmp

Filesize
928KB

Download
memory/2080-125-0x0000000009E20000-0x000000000A3C4000-memory.dmp

Filesize
5.6MB

Download
memory/2080-126-0x0000000005590000-0x0000000005622000-memory.dmp

Filesize
584KB

Download
memory/2080-127-0x0000000005310000-0x000000000531A000-memory.dmp

Filesize
40KB

Download
memory/2080-128-0x0000000008DA0000-0x00000000092CC000-memory.dmp

Filesize
5.2MB

Download
memory/2080-129-0x0000000008A70000-0x0000000008B0C000-memory.dmp

Filesize
624KB

Download
memory/2980-131-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2980-133-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Filesize
408KB

Download