agenttesla | 0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81

General

Target

0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe
Size

753KB
MD5

cc508061b7e46c2d3c5152bac6abe356
SHA1

e6fa2e72beac848a49d0425b300c98ca94f99131
SHA256

0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81
SHA512

b5daaddb2e4cc883c878b9b0d57c9c133ef80b882ea0bbc5fba0adb257f270c8faa3d752899bddf7c91c683ffa16c077a8eef127598a08401983f15338591298

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4832-131-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe
4832	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88
PID 4580 wrote to memory of 4832	4580	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	88

memory/4580-124-0x0000000000B30000-0x0000000000BF2000-memory.dmp

Filesize
776KB

Download
memory/4580-125-0x000000000A070000-0x000000000A614000-memory.dmp

Filesize
5.6MB

Download
memory/4580-126-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/4580-127-0x00000000056D0000-0x00000000056DA000-memory.dmp

Filesize
40KB

Download
memory/4580-128-0x0000000008FF0000-0x000000000951C000-memory.dmp

Filesize
5.2MB

Download
memory/4580-129-0x0000000008D60000-0x0000000008DFC000-memory.dmp

Filesize
624KB

Download
memory/4832-131-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4832-132-0x0000000006300000-0x0000000006366000-memory.dmp

Filesize
408KB

Download