YARA rules for Agenttesla
4 rules from 4 sources detect Agenttesla. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware, Suspicious / hunting.
Family grouping is heuristic: check each rule's description.
Scan files with all Agenttesla rulesSearch rules
No description has been set in the source file - EmbeeResearch
MalwareEmbee Research· Matthew @embee_research· 2023-09-21AgentTesla V3 JIT native string decryption
MalwareCAPE Sandbox (CAPEv2)· ClaudioWayne· 2023-09-13Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.
Suspicious / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-05AgentTeslaV3 infostealer payload
MalwareditekSHen detection· ditekSHen· 2020-11-06