Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
documentos Fedex.js
General
Target
Size
Sample
documentos Fedex.js
1KB
220103-rt6ahahhal
Score
10 /10
MD5
SHA1
SHA256
SHA512
42a82a614937b74596344fa2a1a7c737
c13081e8eba34ca1619f7e8a11e2e8677878d292
46dd53f3096877a4cad89b77f2d23018d8bc5887a9c0d699cb43ffe9d0b5e29d
a9841b2fb08bc50a6476d366d5f8a44e1dec00d541f81e2a5829a09221313efe535470d06b0c5aa5c4d3beb3c4c18a72f96cfab329e88e66b39ce416ad7bc601
Malware Config
Targets
Target
MD5
Filesize
documentos Fedex.js
42a82a614937b74596344fa2a1a7c737
1KB
Score
10/10
SHA1
SHA256
SHA512
c13081e8eba34ca1619f7e8a11e2e8677878d292
46dd53f3096877a4cad89b77f2d23018d8bc5887a9c0d699cb43ffe9d0b5e29d
a9841b2fb08bc50a6476d366d5f8a44e1dec00d541f81e2a5829a09221313efe535470d06b0c5aa5c4d3beb3c4c18a72f96cfab329e88e66b39ce416ad7bc601
Tags
Signatures
-
AgentTesla
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Description
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Tags
-
AgentTesla Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Description
Email clients store some user data on disk where infostealers will often target it.
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses Microsoft Outlook profiles
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks