Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
haitianx.exe
General
Target
Size
Sample
haitianx.exe
45KB
210121-jz6gmpnqh6
Score
10 /10
MD5
SHA1
SHA256
SHA512
c2a516ecaa7cd7627eee19decabbedb6
5799c2d794a9f961e54e4e9726a847bc6fdc52e0
c29a5c591efd9fd4dab5c5f29fbec995829618ac2c2256523bac884182574e49
3fece40243b87f4ea6f48796e7086350b080be46f11bae66d4cfc2738de6de78a1a7ec5950aaece71d44b34668b9206a431802b48de87f0980dc23d4f98f69e9
Malware Config
Targets
Target
MD5
Filesize
haitianx.exe
c2a516ecaa7cd7627eee19decabbedb6
45KB
Score
10 /10
SHA1
SHA256
SHA512
5799c2d794a9f961e54e4e9726a847bc6fdc52e0
c29a5c591efd9fd4dab5c5f29fbec995829618ac2c2256523bac884182574e49
3fece40243b87f4ea6f48796e7086350b080be46f11bae66d4cfc2738de6de78a1a7ec5950aaece71d44b34668b9206a431802b48de87f0980dc23d4f98f69e9
Tags
Signatures
-
AgentTesla
-
Reads data files stored by FTP clients
Description
Tries to access configuration files associated with programs like FileZilla.
Tags
TTPs
-
Reads user/profile data of local email clients
Description
Email clients store some user data on disk where infostealers will often target it.
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks