Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
Outstanding invoices.exe
General
Target
Size
Sample
Outstanding invoices.exe
528KB
210408-9p9897j126
Score
10 /10
MD5
SHA1
SHA256
SHA512
95df4d14a28e363ce70d5d7962427c24
ffcdfb4eb40d64eb13e50ee13c0ae9a73a9ee8ee
e9573722d616d444c71e82f1ac6973921f3c942af4403760e0292b3ebf9159b0
983c7bb6d01ac1729c86fc994ebbb9bb40b1dd1bd27b2ff96d8a32a3b1b547d1fb2fd3e2f24d2b8b5cedb1e10dbb666a6ced71b8d89c94595ed3b46cc8df16e6
Malware Config
Extracted
| Family | agenttesla |
| Credentials |
Protocol: smtp Host: smtp.babcockvalve.com Port: 587 Username: ziara.landa@babcockvalve.com Password: hA$ks@%9 |
Targets
Target
MD5
Filesize
Outstanding invoices.exe
95df4d14a28e363ce70d5d7962427c24
528KB
Score
10 /10
SHA1
SHA256
SHA512
ffcdfb4eb40d64eb13e50ee13c0ae9a73a9ee8ee
e9573722d616d444c71e82f1ac6973921f3c942af4403760e0292b3ebf9159b0
983c7bb6d01ac1729c86fc994ebbb9bb40b1dd1bd27b2ff96d8a32a3b1b547d1fb2fd3e2f24d2b8b5cedb1e10dbb666a6ced71b8d89c94595ed3b46cc8df16e6
Tags
Signatures
-
AgentTesla
-
AgentTesla Payload
-
Nirsoft
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Description
Tries to access configuration files associated with programs like FileZilla.
Tags
TTPs
-
Reads user/profile data of local email clients
Description
Email clients store some user data on disk where infostealers will often target it.
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks