Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
CT_7093164285.exe
General
Target
Size
Sample
CT_7093164285.exe
852KB
210408-gtbsjxwrbx
Score
10 /10
MD5
SHA1
SHA256
SHA512
4115754d5b0d6ab49aed7fdde034d04a
6eb5fbd8c35001249521652c36c0cb9feccddbbe
67e40f25962f1a77b84cc4a4b990bf99041924736e11b55e74edef29816ef3ec
27b8c0c266d8836499c3e1c4496569cd23364f925933708e1ced61ed682eae1733919c6e09e4e2f0dcd1e2d5bd76a8843f1b0b6b89a95ae779d04cfd1c00a012
Malware Config
Extracted
| Family | agenttesla |
| Credentials |
Protocol: smtp Host: mail.chrismehat.com Port: 587 Username: market@chrismehat.com Password: vStcCO~Cyox6 |
Targets
Target
MD5
Filesize
CT_7093164285.exe
4115754d5b0d6ab49aed7fdde034d04a
852KB
Score
10 /10
SHA1
SHA256
SHA512
6eb5fbd8c35001249521652c36c0cb9feccddbbe
67e40f25962f1a77b84cc4a4b990bf99041924736e11b55e74edef29816ef3ec
27b8c0c266d8836499c3e1c4496569cd23364f925933708e1ced61ed682eae1733919c6e09e4e2f0dcd1e2d5bd76a8843f1b0b6b89a95ae779d04cfd1c00a012
Tags
Signatures
-
AgentTesla
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks