Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Agent Tesla, AgentTesla | A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel. |
|
|
AV Detection |
---|
Source: |
Malware Configuration Extractor: |
Source: |
ReversingLabs: |
|||
Source: |
Virustotal: |
Perma Link |
Source: |
Joe Sandbox ML: |
Source: |
Static PE information: |
Source: |
Binary string: |
||
Source: |
Binary string: |
Source: |
Code function: |
0_2_00C74696 | |
Source: |
Code function: |
0_2_00C7C9C7 | |
Source: |
Code function: |
0_2_00C7C93C | |
Source: |
Code function: |
0_2_00C7F200 | |
Source: |
Code function: |
0_2_00C7F35D | |
Source: |
Code function: |
0_2_00C7F65E | |
Source: |
Code function: |
0_2_00C73A2B | |
Source: |
Code function: |
0_2_00C73D4E | |
Source: |
Code function: |
0_2_00C7BF27 |
Source: |
Code function: |
0_2_00C825E2 |
Source: |
Code function: |
0_2_00C8425A |
Source: |
Code function: |
0_2_00C84458 |
Source: |
Code function: |
0_2_00C8425A |
Source: |
Code function: |
0_2_00C70219 |
Source: |
Code function: |
0_2_00C9CDAC |
System Summary |
---|
Source: |
Code function: |
0_2_00C13B4C | |
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
memstr_0c27cfb5-b | |
Source: |
String found in binary or memory: |
memstr_cf678d7f-8 | |
Source: |
String found in binary or memory: |
memstr_5e26b6b0-a | |
Source: |
String found in binary or memory: |
memstr_406fd882-6 |
Source: |
Code function: |
0_2_00C740B1 |
Source: |
Code function: |
0_2_00C68858 |
Source: |
Code function: |
0_2_00C7545F |
Source: |
Code function: |
0_2_00C1E800 | |
Source: |
Code function: |
0_2_00C3DBB5 | |
Source: |
Code function: |
0_2_00C9804A | |
Source: |
Code function: |
0_2_00C1E060 | |
Source: |
Code function: |
0_2_00C24140 | |
Source: |
Code function: |
0_2_00C32405 | |
Source: |
Code function: |
0_2_00C46522 | |
Source: |
Code function: |
0_2_00C90665 | |
Source: |
Code function: |
0_2_00C4267E | |
Source: |
Code function: |
0_2_00C26843 | |
Source: |
Code function: |
0_2_00C3283A | |
Source: |
Code function: |
0_2_00C489DF | |
Source: |
Code function: |
0_2_00C90AE2 | |
Source: |
Code function: |
0_2_00C46A94 | |
Source: |
Code function: |
0_2_00C28A0E | |
Source: |
Code function: |
0_2_00C6EB07 | |
Source: |
Code function: |
0_2_00C78B13 | |
Source: |
Code function: |
0_2_00C3CD61 | |
Source: |
Code function: |
0_2_00C47006 | |
Source: |
Code function: |
0_2_00C23190 | |
Source: |
Code function: |
0_2_00C2710E | |
Source: |
Code function: |
0_2_00C11287 | |
Source: |
Code function: |
0_2_00C333C7 | |
Source: |
Code function: |
0_2_00C3F419 | |
Source: |
Code function: |
0_2_00C316C4 | |
Source: |
Code function: |
0_2_00C25680 | |
Source: |
Code function: |
0_2_00C258C0 | |
Source: |
Code function: |
0_2_00C378D3 | |
Source: |
Code function: |
0_2_00C31BB8 | |
Source: |
Code function: |
0_2_00C49D05 | |
Source: |
Code function: |
0_2_00C1FE40 | |
Source: |
Code function: |
0_2_00C31FD0 | |
Source: |
Code function: |
0_2_00C3BFE6 | |
Source: |
Code function: |
0_2_01483670 | |
Source: |
Code function: |
2_2_01604110 | |
Source: |
Code function: |
2_2_0160D048 | |
Source: |
Code function: |
2_2_01604D28 | |
Source: |
Code function: |
2_2_01609DD0 | |
Source: |
Code function: |
2_2_01604458 |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Static PE information: |
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
||
Source: |
Cryptographic APIs: |
Source: |
Classification label: |
Source: |
Code function: |
0_2_00C7A2D5 |
Source: |
Code function: |
0_2_00C68713 | |
Source: |
Code function: |
0_2_00C68CC3 |
Source: |
Code function: |
0_2_00C7B59E |
Source: |
Code function: |
0_2_00C8F121 |
Source: |
Code function: |
0_2_00C886D0 |
Source: |
Code function: |
0_2_00C14FE9 |
Source: |
Mutant created: |
Source: |
File created: |
Jump to behavior |
Source: |
Static PE information: |
Source: |
WMI Queries: |
Source: |
File read: |
Jump to behavior |
Source: |
Key opened: |
Jump to behavior |
Source: |
Binary or memory string: |
Source: |
ReversingLabs: |
||
Source: |
Virustotal: |
Source: |
Process created: |
|||
Source: |
Process created: |
|||
Source: |
Process created: |
Jump to behavior |
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior |
Source: |
Key value queried: |
Jump to behavior |
Source: |
Key opened: |
Jump to behavior |
Source: |
Static file information: |
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
Source: |
Static PE information: |
Source: |
Binary string: |
||
Source: |
Binary string: |
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
Source: |
Code function: |
0_2_00C8C304 |
Source: |
Code function: |
0_2_00C38B98 | |
Source: |
Code function: |
0_2_00C2554A |
Source: |
Code function: |
0_2_00C14A35 | |
Source: |
Code function: |
0_2_00C955FD |
Source: |
Code function: |
0_2_00C333C7 |
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior |
Malware Analysis System Evasion |
---|
Source: |
WMI Queries: |
Source: |
Evasive API call chain: |
Source: |
API coverage: |
Source: |
WMI Queries: |
Source: |
WMI Queries: |
Source: |
Code function: |
0_2_00C74696 | |
Source: |
Code function: |
0_2_00C7C9C7 | |
Source: |
Code function: |
0_2_00C7C93C | |
Source: |
Code function: |
0_2_00C7F200 | |
Source: |
Code function: |
0_2_00C7F35D | |
Source: |
Code function: |
0_2_00C7F65E | |
Source: |
Code function: |
0_2_00C73A2B | |
Source: |
Code function: |
0_2_00C73D4E | |
Source: |
Code function: |
0_2_00C7BF27 |
Source: |
Code function: |
0_2_00C14AFE |
Source: |
API call chain: |
||
Source: |
API call chain: |
Source: |
Code function: |
0_2_00C841FD |
Source: |
Code function: |
0_2_00C13B4C |
Source: |
Code function: |
0_2_00C45CCC |
Source: |
Code function: |
0_2_00C8C304 |
Source: |
Code function: |
0_2_01483560 | |
Source: |
Code function: |
0_2_01483500 | |
Source: |
Code function: |
0_2_01481ED0 |
Source: |
Code function: |
0_2_00C681F7 |
Source: |
Code function: |
0_2_00C3A395 | |
Source: |
Code function: |
0_2_00C3A364 |
Source: |
Memory allocated: |
Jump to behavior |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: |
Section loaded: |
Jump to behavior |
Source: |
Memory written: |
Jump to behavior |
Source: |
Code function: |
0_2_00C68C93 |
Source: |
Code function: |
0_2_00C13B4C |
Source: |
Code function: |
0_2_00C14A35 |
Source: |
Code function: |
0_2_00C74EC9 |
Source: |
Process created: |
Jump to behavior |
Source: |
Code function: |
0_2_00C681F7 |
Source: |
Code function: |
0_2_00C74C03 |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Code function: |
0_2_00C3886B |
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior | ||
Source: |
Queries volume information: |
Jump to behavior |
Source: |
Code function: |
0_2_00C450D7 |
Source: |
Code function: |
0_2_00C52230 |
Source: |
Code function: |
0_2_00C4418A |
Source: |
Code function: |
0_2_00C14AFE |
Source: |
Key value queried: |
Jump to behavior |
Stealing of Sensitive Information |
---|
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior |
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
Key opened: |
Jump to behavior | ||
Source: |
Key opened: |
Jump to behavior |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Remote Access Functionality |
---|
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Source: |
Code function: |
0_2_00C86596 | |
Source: |
Code function: |
0_2_00C86A5A |