Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7
General
Target
Size
Sample
e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7
320KB
220521-xkgtfabhf3
Score
10 /10
MD5
SHA1
SHA256
SHA512
4ca72cdf95f603248189bee49f9291d5
5743ae6c2f3bda1b139db68109ba0a146c908763
e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7
a567c844c58f675284565bed7ed726b803b0ab5756d25b3477331fa31cbea4fe192f2e48dcffc43d99d6e3710e5bf93b4e810b220ef5e0c68677b8b291944e23
Malware Config
Extracted
| Family | agenttesla |
| Credentials | Protocol: smtp Host: mail.privateemail.com Port: 587 Username: jinghao20@jinghao.pw Password: Igboamaka1 |
Targets
Target
MD5
Filesize
RFQ..exe
976be92376c72a2c0c4927d2f0a13651
363KB
Score
10/10
SHA1
SHA256
SHA512
c6b4a69ebd63382be533a9e2e4dc7c51e5c852d1
d7bd54e41dbe29893e23fef937a9579c238abaf34196fb8905c3313192ed2393
eb8bfcb357648cebf8116b744b064dfa05de0c97f8d5a38d24150a21792ef5e7de3d24133af97346fb66b4f58be423d21e5e868a7de8eafe14f345be3de3fd42
Tags
Signatures
-
AgentTesla
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Description
Tries to access configuration files associated with programs like FileZilla.
Tags
TTPs
-
Reads user/profile data of local email clients
Description
Email clients store some user data on disk where infostealers will often target it.
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses Microsoft Outlook profiles
Tags
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks