Tracking and Responding to AgentTesla Using EDR

AhnLab Security Emergency response Center (ASEC) has been uploading a summary of weekly malware statistics every week.

https://asec.ahnlab.com/en/53647/

This post will cover how EDR is used to detect, track, and respond to AgentTesla, an Infostealer continuously being distributed among the malware mentioned in the post above.

AgentTesla is an Infostealer that steals user credentials saved in web browsers, emails, and FTP clients. AhnLab’s EDR products detect certain types of PE files accessing user account credential files and categorize this behavior …

agenttesla ahnlab asec center credentials detect distributed edr emergency infostealer malware malware analysis malware statistics respond response security statistics tracking weekly