AgentTesla RAT Malware Analysis

A short malware analysis project focused on static and dynamic analysis of an AgentTesla sample using FlareVM and industry-standard forensic tools.

🔍 Overview

This project analyzes an AgentTesla RAT sample obtained from MalwareBazaar to understand:

• Malware behavior
• Persistence mechanisms
• Evasion techniques
• Network activity
• Indicators of Compromise (IOCs)

🛠 Tools Used

• FlareVM
• PEview
• CFF Explorer
• FLOSS
• Resource Hacker
• Dependency Walker
• YARA
• Process Monitor
• Process Explorer
• RegShot
• Wireshark

📌 Key Findings

• .NET-based malware with hidden imports
• Fake “Virtual Houseplant” decoy GUI
• Persistence via Startup folder + PowerShell bypass
• Screenshot capture capability
• DNS connectivity checks to Microsoft domains
• Custom YARA rule successfully detected sample

🚨 IOCs

• Dropped file: llujTO.exe
• Startup shortcut: llujTO.lnk
• SHA256: 301f45ab43a8e2bb80c54b6f4b5ba7b45b528b0b786a64fe40e8c3b4945baf3f

📚 Skills Demonstrated

• Malware Analysis
• Threat Hunting
• YARA Rule Writing
• Windows Internals
• Dynamic Analysis
• DFIR Techniques

👨‍💻 Author

Aryan Hirapara M.Sc. DFIS — National Forensic Sciences University