Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
L9oOm9x3I7YZFcA.exe
General
Target
Size
Sample
L9oOm9x3I7YZFcA.exe
1MB
210122-zsckm3ek12
Score
10 /10
MD5
SHA1
SHA256
SHA512
4ae13376f629270025f6113b6fef91db
d7efd57f3ff3dd58bfff40d18c8dd70d58b2a1fa
b7f4f41e2140b9416ccfd8d0c89523bf774b9577302b107f8b143c5bdd3f6534
3c18523e21574ab3e63f4ef4874ed5aaab01cfcb38b1cf0c40941ccdf1c5c436765bf3b6776a1215841472ecbe034fdce9b2025dc0cac8727e26d9fc9eaaddf8
Malware Config
Targets
Target
MD5
Filesize
L9oOm9x3I7YZFcA.exe
4ae13376f629270025f6113b6fef91db
1MB
Score
10 /10
SHA1
SHA256
SHA512
d7efd57f3ff3dd58bfff40d18c8dd70d58b2a1fa
b7f4f41e2140b9416ccfd8d0c89523bf774b9577302b107f8b143c5bdd3f6534
3c18523e21574ab3e63f4ef4874ed5aaab01cfcb38b1cf0c40941ccdf1c5c436765bf3b6776a1215841472ecbe034fdce9b2025dc0cac8727e26d9fc9eaaddf8
Tags
Signatures
-
AgentTesla
-
Reads data files stored by FTP clients
Description
Tries to access configuration files associated with programs like FileZilla.
Tags
TTPs
-
Reads user/profile data of local email clients
Description
Email clients store some user data on disk where infostealers will often target it.
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks