Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
Order 21-21.doc
1MB
210121-h2y5pe8x7s
7c2eddeb04db10bd3f18c209e44f8ee5
9ea7737b937666839fc2697fd105036ad22b6db9
6b4736cadf2ab0f4477b857257ec184758cd846ebae168b2ccc4af62e6871835
3e378ea1f6c5d6c2dec9c01d9aca73ab0bde58c1b79b709186dbec7a204c918092c5c57d469639abfe4b3154e2dd73cc425aaf172e9e02661bc96c73980c6f78
Order 21-21.doc
7c2eddeb04db10bd3f18c209e44f8ee5
1MB
9ea7737b937666839fc2697fd105036ad22b6db9
6b4736cadf2ab0f4477b857257ec184758cd846ebae168b2ccc4af62e6871835
3e378ea1f6c5d6c2dec9c01d9aca73ab0bde58c1b79b709186dbec7a204c918092c5c57d469639abfe4b3154e2dd73cc425aaf172e9e02661bc96c73980c6f78
Agent Tesla is a remote access tool (RAT) written in visual basic.
Tries to access configuration files associated with programs like FileZilla.
Email clients store some user data on disk where infostealers will often target it.
Infostealers often target stored browser data, which can include saved credentials etc.
Uses a legitimate IP lookup service to find the infected system's external IP.
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.