Agent Tesla Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	818
zh	56
de	26
fr	18
ru	16

Country

us	410
cn	84
ru	34
es	18
gb	14

Actors

Agent Tesla	21
Cobalt Strike	19
Mirai	15
RedLine Stealer	15
AsyncRAT	13

Activities

Interest

Timeline

Type

Not Defined	388
Operating System	54
Content Management System	38
Programming Language Software	26
WordPress Plugin	24

Vendor

Not Defined	328
Microsoft	50
Apple	34
SourceCodester	22
Oracle	18

Product

Microsoft Windows	26
Apple macOS	12
WordPress	12
nginx	8
Linux Kernel	8

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.00	0.01806	CVE-2007-1192
2	Vmware Workspace ONE Access/Identity Manager Template injection	9.8	8.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.97361	CVE-2022-22954
3	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	3.34	0.00000	CVE-2020-12440
4	Basti2web Book Panel books.php sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.09	0.00064	CVE-2009-4889
5	vsftpd deny_file unknown vulnerability	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00312	CVE-2015-1419
6	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.84	0.00954	CVE-2010-0966
7	LogicBoard CMS away.php redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	2.23	0.00000
8	CodeIgniter Reverse Proxy getIPAddress data authenticity	6.7	6.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00048	CVE-2022-23556
9	Tiki Wiki CMS Groupware tiki-edit_wiki_section.php cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.00110	CVE-2010-4240
10	Guangzhou 1GE ONU/V2804RGW formPing os command injection	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.74227	CVE-2020-8958
11	Telecommunication Software SAMwin Contact Center Suite Credential SAMwinLIBVB.dll getCurrentDBVersion hard-coded credentials	6.5	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.12	0.00128	CVE-2013-10002
12	FLDS redir.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.28	0.00203	CVE-2008-5928
13	PHP Link Directory Administration Page index.html cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.68	0.00352	CVE-2007-0529
14	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	1.03	0.03421	CVE-2007-0354
15	PHPMailer Phar Deserialization addAttachment deserialization	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.08	0.00383	CVE-2020-36326
16	Tiki TikiWiki tiki-editpage.php input validation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.04	0.01673	CVE-2004-1386
17	Pligg cloud.php sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.84	0.00000
18	RARLabs WinRAR ZIP Archive Remote Code Execution	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.23404	CVE-2023-38831
19	1C-Bitrix Bitrix24 AD/LDAP ldap_server_edit.php insufficiently protected credentials	4.6	4.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00064	CVE-2022-43959
20	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.20	0.00897	CVE-2007-1287

Campaigns (1)

These are the campaigns that can be associated with the actor:

Phishing Korea

IOC - Indicator of Compromise (81)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	2.9.12.0	anantes-154-1-77-net.w2-9.abo.wanadoo.fr	Agent Tesla		10/15/2018	verified	High
2	3.93.18.244	ec2-3-93-18-244.compute-1.amazonaws.com	Agent Tesla		09/07/2022	verified	Medium
3	3.217.248.28	ec2-3-217-248-28.compute-1.amazonaws.com	Agent Tesla		09/07/2022	verified	Medium
4	5.253.38.46		Agent Tesla		10/02/2023	verified	High
5	23.95.85.181	23-95-85-181-host.colocrossing.com	Agent Tesla		06/12/2022	verified	High
6	23.95.128.195	23-95-128-195-host.colocrossing.com	Agent Tesla		09/06/2023	verified	High
7	31.3.251.197	h31-3-251-197.host.redstation.co.uk	Agent Tesla		03/31/2022	verified	High
8	31.209.137.12	smtp.vivaldi.net	Agent Tesla		06/11/2022	verified	High
9	31.220.2.200	shared.swiftslots.com	Agent Tesla		11/02/2023	verified	High
10	34.200.207.31	ec2-34-200-207-31.compute-1.amazonaws.com	Agent Tesla		09/07/2022	verified	Medium
11	37.19.196.108	unn-37-19-196-108.datapacket.com	Agent Tesla		06/11/2022	verified	High
12	43.230.131.138	srv1.nusadatacenter.com	Agent Tesla		11/12/2023	verified	High
13	45.142.215.180	connectoms.host	Agent Tesla		05/18/2022	verified	High
14	45.156.25.78		Agent Tesla		05/18/2022	verified	High
15	46.166.133.164	cybersubtitles.com	Agent Tesla		10/15/2018	verified	High
16	47.87.211.157		Agent Tesla		09/23/2023	verified	High
17	50.17.5.224	ec2-50-17-5-224.compute-1.amazonaws.com	Agent Tesla		06/11/2022	verified	Medium
18	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxxxx Xxxxx		05/05/2022	verified	High
19	XX.XX.XXX.XX	xx.xxxx.xxx.xxxx.xxxxxxx	Xxxxx Xxxxx		05/05/2022	verified	High
20	XX.XXX.XXX.XXX		Xxxxx Xxxxx		05/18/2022	verified	High
21	XX.XX.XX.XX	xxxxxx.xx.xx.xx.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxx Xxxxx		05/18/2022	verified	High
22	XX.XXX.XXX.XX	xxxx.xxxxxxxxx.xxx	Xxxxx Xxxxx		09/27/2023	verified	High
23	XX.XXX.XX.XXX	xxxxxxxxxx.xxxxxxxxx.xxx	Xxxxx Xxxxx	Xxxxxxxx Xxxxx	03/03/2022	verified	High
24	XX.XXX.XXX.XXX		Xxxxx Xxxxx		06/21/2022	verified	High
25	XX.XXX.XX.XXX	xx.xxxxxxxx.xxx	Xxxxx Xxxxx		07/06/2022	verified	High
26	XX.XXX.XXX.XX		Xxxxx Xxxxx		05/05/2022	verified	High
27	XX.XX.XXX.XX	xxxxxxxx.xxxxxxx.xxxxx	Xxxxx Xxxxx		07/12/2023	verified	High
28	XX.XXX.XXX.XXX		Xxxxx Xxxxx		07/05/2023	verified	High
29	XX.XX.X.XX		Xxxxx Xxxxx		10/15/2023	verified	High
30	XX.XX.XXX.XX		Xxxxx Xxxxx		11/06/2023	verified	High
31	XX.XXX.XXX.XX	xxxx-xxx-xx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		05/30/2022	verified	High
32	XX.XXX.XX.XX		Xxxxx Xxxxx		03/24/2023	verified	High
33	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		11/09/2021	verified	High
34	XXX.XXX.XX.X		Xxxxx Xxxxx		07/29/2022	verified	High
35	XXX.XXX.XXX.XX		Xxxxx Xxxxx		04/06/2022	verified	High
36	XXX.XX.XXX.XX		Xxxxx Xxxxx		05/05/2022	verified	High
37	XXX.XXX.XX.XX	xxx-xxx-xx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		07/06/2022	verified	High
38	XXX.XXX.XXX.XX		Xxxxx Xxxxx		03/31/2022	verified	High
39	XXX.XXX.XXX.XX		Xxxxx Xxxxx		03/31/2022	verified	High
40	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/31/2022	verified	High
41	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/31/2022	verified	High
42	XXX.XXX.XXX.XX		Xxxxx Xxxxx		03/31/2022	verified	High
43	XXX.XXX.XXX.XX		Xxxxx Xxxxx		03/31/2022	verified	High
44	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/31/2022	verified	High
45	XXX.XXX.XXX.XX		Xxxxx Xxxxx		03/31/2022	verified	High
46	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/31/2022	verified	High
47	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/31/2022	verified	High
48	XXX.XXX.XXX.XX		Xxxxx Xxxxx		03/31/2022	verified	High
49	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/31/2022	verified	High
50	XXX.XXX.XXX.XXX	xxxx-xxxxx.xxxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx		08/24/2021	verified	High
51	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxx.xxxxxx	Xxxxx Xxxxx		10/04/2023	verified	High
52	XXX.XXX.X.XX	xxxx.xxxxxxxxx.xxxx	Xxxxx Xxxxx		07/22/2023	verified	High
53	XXX.XX.XXX.XX	xxxxxx-xxxx-xx.xxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx		07/13/2023	verified	High
54	XXX.XX.X.XXX		Xxxxx Xxxxx		10/10/2023	verified	High
55	XXX.XX.XXX.XXX	xxxxx.xx-xxx-xx-xxx.xxx	Xxxxx Xxxxx	Xxxxxxxx Xxxxx	03/03/2022	verified	High
56	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		07/06/2022	verified	High
57	XXX.XXX.XXX.XX	xxxxxxxx.xxxxxxxxxxx.xxx	Xxxxx Xxxxx		07/06/2022	verified	High
58	XXX.XXX.XX.XX	xxxx-xxx.xx-xxx.xxx	Xxxxx Xxxxx		06/12/2022	verified	High
59	XXX.XX.XX.XXX		Xxxxx Xxxxx		05/19/2023	verified	High
60	XXX.XX.XX.XXX		Xxxxx Xxxxx		05/19/2023	verified	High
61	XXX.XX.XXX.XXX	xxxxxxxx.xxxxxxxxxxx.xxx	Xxxxx Xxxxx		04/06/2023	verified	High
62	XXX.XX.XX.XX	xxxxxxxx.xxxxxxxxxx.xx	Xxxxx Xxxxx		05/18/2022	verified	High
63	XXX.XXX.XX.XX	xxxxxxxxxx-xxxx.xxxx.xxxxxxx	Xxxxx Xxxxx		05/18/2022	verified	High
64	XXX.XXX.XX.XX		Xxxxx Xxxxx		01/17/2023	verified	High
65	XXX.XXX.XXX.XX		Xxxxx Xxxxx		05/19/2023	verified	High
66	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		12/27/2022	verified	High
67	XXX.XXX.XXX.XX		Xxxxx Xxxxx		05/25/2023	verified	High
68	XXX.XXX.XXX.XXX	xxxx.xxxxxxxxxx.xx	Xxxxx Xxxxx		05/19/2023	verified	High
69	XXX.XX.XX.XXX		Xxxxx Xxxxx		08/10/2022	verified	High
70	XXX.XXX.XX.XX	xxxxxxxx.xxxx.xxx	Xxxxx Xxxxx		05/05/2022	verified	High
71	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		07/29/2022	verified	High
72	XXX.XXX.XXX.XX		Xxxxx Xxxxx		12/06/2022	verified	High
73	XXX.XX.XXX.X	xxx-xx-xxx-x-xxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		07/06/2022	verified	High
74	XXX.XX.XXX.XXX		Xxxxx Xxxxx		05/05/2022	verified	High
75	XXX.XX.XX.XXX	xxxxx.xxxxxxxxxx.xxx	Xxxxx Xxxxx		01/16/2023	verified	High
76	XXX.XX.XXX.XXX	x-xxxx.x-xxxxxx.xxx	Xxxxx Xxxxx		05/05/2022	verified	High
77	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		05/05/2022	verified	High
78	XXX.XX.XXX.XX	xxx.xxxxxxxx.xxx	Xxxxx Xxxxx		06/12/2022	verified	High
79	XXX.XX.XXX.XXX	xxx.xxxxxxxx.xxxxxxxxxxx.xxx	Xxxxx Xxxxx		03/04/2022	verified	High
80	XXX.XX.XXX.XXX	xxx.xxxxxxxx.xxxxxxxxxxx.xxx	Xxxxx Xxxxx		06/12/2022	verified	High
81	XXX.XXX.XX.XXX	xxxxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		03/22/2023	verified	High

TTP - Tactics, Techniques, Procedures (26)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-21, CWE-22	Pathname Traversal	predictive	High
2	T1040	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CWE-74	Injection	predictive	High
4	T1059	CWE-88, CWE-94, CWE-1321	Cross Site Scripting	predictive	High
5	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
6	T1068	CWE-264, CWE-266, CWE-269, CWE-274, CWE-284	J2EE Misconfiguration: Weak Access Permissions for EJB Methods	predictive	High
7	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
12	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX	CWE-XXX	Xxx Xx Xxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
14	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxx	predictive	High
16	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
17	TXXXX	CWE-XXX	Xxxxxxxx Xxxxxxxxx Xx X Xxxxxxxxxxx'x Xxxxx Xx Xxxxx	predictive	High
18	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
19	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
20	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	High
21	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxxxxxxxxx Xx Xx Xxxxxxxxxxxx Xxxxx	predictive	High
22	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx	predictive	High
23	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High
24	TXXXX.XXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
25	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High
26	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (421)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/+CSCOE+/logon.html	predictive	High
2	File	/admin/ajax.php	predictive	High
3	File	/admin/ajax.php?action=save_window	predictive	High
4	File	/api/baskets/{name}	predictive	High
5	File	/app/options.py	predictive	High
6	File	/be/erpc.php	predictive	Medium
7	File	/bitrix/admin/ldap_server_edit.php	predictive	High
8	File	/booking/show_bookings/	predictive	High
9	File	/config/list	predictive	Medium
10	File	/controller/Index.php	predictive	High
11	File	/csms/?page=contact_us	predictive	High
12	File	/dashboard/add-portfolio.php	predictive	High
13	File	/data/app	predictive	Medium
14	File	/dev/wabi	predictive	Medium
15	File	/etc/gsissh/sshd_config	predictive	High
16	File	/etc/sudoers	predictive	Medium
17	File	/forum/away.php	predictive	High
18	File	/goform/WifiBasicSet	predictive	High
19	File	/include/chart_generator.php	predictive	High
20	File	/inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml	predictive	High
21	File	/lilac/main.php	predictive	High
22	File	/login.php	predictive	Medium
23	File	/mc	predictive	Low
24	File	/mims/login.php	predictive	High
25	File	/module/admin_bp/add_application.php	predictive	High
26	File	/module/report_event/index.php	predictive	High
27	File	/modules/profile/index.php	predictive	High
28	File	/news-portal-script/information.php	predictive	High
29	File	/out.php	predictive	Medium
30	File	/proc/sys/vm/cmm_timeout	predictive	High
31	File	/public/launchNewWindow.jsp	predictive	High
32	File	/RestAPI	predictive	Medium
33	File	/reviewer/system/system/admins/manage/users/user-update.php	predictive	High
34	File	/royal_event/companyprofile.php	predictive	High
35	File	/server-status	predictive	High
36	File	/showfile.php	predictive	High
37	File	/spip.php	predictive	Medium
38	File	/staff/bookdetails.php	predictive	High
39	File	/Status/wan_button_action.asp	predictive	High
40	File	/student/bookdetails.php	predictive	High
41	File	/uncpath/	predictive	Medium
42	File	/upload	predictive	Low
43	File	/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php	predictive	High
44	File	/var/log/nginx	predictive	High
45	File	/wbg/core/_includes/authorization.inc.php	predictive	High
46	File	/wp-admin/options.php	predictive	High
47	File	/youthappam/add-food.php	predictive	High
48	File	/youthappam/editclient.php	predictive	High
49	File	?page=rooms	predictive	Medium
50	File	xxxxxxxxxxxx.xxx	predictive	High
51	File	xxxxx.xxx	predictive	Medium
52	File	xxxxx.xxxx	predictive	Medium
53	File	xxxxx.xxx?x=xxxxxx&x=xxxxxx&x=xxxxxx	predictive	High
54	File	xxxxx/xxxxx.xxx	predictive	High
55	File	xxxxx/xxxxxx.xxxxxxxxx_xxxxx.xxx	predictive	High
56	File	xxxxx/xxxxxx.xxxxx_xxxxxx.xxx	predictive	High
57	File	xxxxx/xxxxxx/xxxxx-xxxxxx-xxxxxxxx.xxx	predictive	High
58	File	xxxxx/xxxxx.xxx	predictive	High
59	File	xxxxxxxxxxxx.xxx	predictive	High
60	File	xxxxx_xxxxx.xxx	predictive	High
61	File	xxxxx_xxxxxxx.xxxx	predictive	High
62	File	xxx.xxx	predictive	Low
63	File	xxxx/xxxxxxxxx.xxx	predictive	High
64	File	xxxxxxxxxxxxx.xxx	predictive	High
65	File	xxx/xxxxx/xxxxxxx/xxxx-xxx-xxxxxxx-xxxxxx.xxx	predictive	High
66	File	xxxxxxxxxxx/xxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxx.xxxxx.xxx	predictive	High
67	File	xxx.xxx	predictive	Low
68	File	xxxxxxx.xx	predictive	Medium
69	File	xxxxxxx/xxxxx/xxxxxxxx	predictive	High
70	File	xxxxx.xxx	predictive	Medium
71	File	xxxx_xx.xx	predictive	Medium
72	File	x:\xxxx	predictive	Low
73	File	xxxx.xxx	predictive	Medium
74	File	xxxx_xxx.xxx	predictive	Medium
75	File	xxxxxxxx.xxx	predictive	Medium
76	File	xxxxx/xxxxxxxxx.x	predictive	High
77	File	xxx-xxx/xxx/xxxxxxxx_xxx.xxx	predictive	High
78	File	xxxxxx-xxxxxxxx.xxx	predictive	High
79	File	xxxxxxx.xxx	predictive	Medium
80	File	xxxxx-xxxxxx/xxx/xxxx/xxxxxx/xxx-xxx/xxx/xxxx/xxxxxx.xxx	predictive	High
81	File	xxxxx.xxx	predictive	Medium
82	File	xxx.xxx	predictive	Low
83	File	xxxxxxxxxxxxxxxxxxxxxxxx.xxxxxxxx_x	predictive	High
84	File	xxxxxx_xxx.xxx	predictive	High
85	File	xxxxxxxxxxx/xxxxxx_xxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
86	File	xxxxxxxxx.xxx	predictive	High
87	File	xxx-xxx/xxxxxxxxxxxxx.xxx	predictive	High
88	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
89	File	xxx.xxx	predictive	Low
90	File	xxxxxxxxxxxxx/xxxxxx/xxxx.xxx	predictive	High
91	File	xxxxxxx.xxx	predictive	Medium
92	File	xxx_xxxxxxxxxxxx.xxx	predictive	High
93	File	xxxxxxxxxx_xxxxxx.xxx	predictive	High
94	File	xxxxxx.x	predictive	Medium
95	File	xxxxxxx/xxx/xxxx/xxxx.x	predictive	High
96	File	xxxxxxx/xxx/xxx_xx.x	predictive	High
97	File	xxxxxx/xxxxxxxx	predictive	High
98	File	xxx_xxxx.x	predictive	Medium
99	File	xxxxxxxx.xxx.xxx	predictive	High
100	File	xxxxxxxx.xxx	predictive	Medium
101	File	xxxxx.xxx	predictive	Medium
102	File	xxxxxxx-xxxxxxx/xxxx/xxxxxx/xxxxxxxx/xxx/xxxxxxxxx/xxxxxx.xx	predictive	High
103	File	xxxxxx.xxx	predictive	Medium
104	File	xxxxxxxx.xxx	predictive	Medium
105	File	xxxx/xx/xx	predictive	Medium
106	File	xx/xxxxx/xxxxxxx.x	predictive	High
107	File	xxx/xxxxxx_xxx.x	predictive	High
108	File	xxxxxxxx/xxxx_xxxxxxxx.xxx	predictive	High
109	File	xxxxxxx.xxx	predictive	Medium
110	File	xxxxxxxxxxxx_xxxx.xxx	predictive	High
111	File	xxxxxxxxx.xxx	predictive	High
112	File	xxxxxxxxx.xx	predictive	Medium
113	File	xxxxxxxxxxxxx.xxx	predictive	High
114	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	High
115	File	xxxxx/xxxxxxx/xxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
116	File	xxxxxxxxxxxxxx.xxx	predictive	High
117	File	xxxxxx.xxx	predictive	Medium
118	File	xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
119	File	xxx/xxxxxx.xxx	predictive	High
120	File	xxx/xx-xxxxx.xxx	predictive	High
121	File	xxxxxxx.xxx	predictive	Medium
122	File	xxxxxxxx/xx/xxxxx.xxxxxxxx_xx.xxx	predictive	High
123	File	xxxxxxxx/xxxx/xxxxxx/xxxxx-xxx.xxx.xxx	predictive	High
124	File	xxxxx.xxx	predictive	Medium
125	File	xxxxx.xxxx	predictive	Medium
126	File	xxxxx.xxx	predictive	Medium
127	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	predictive	High
128	File	xxxxx.xx	predictive	Medium
129	File	xxxxxx_xxxxxx.xxx	predictive	High
130	File	xxxxxxx/xxxxxxx.xxx	predictive	High
131	File	xxxxxxx.xxxxx	predictive	High
132	File	xx/xxxxxxxxxx/xxx_xxxxxx/xxxxxxxx.xxx	predictive	High
133	File	xx_xxxxxxxxx_xxxxx.xxx	predictive	High
134	File	xxxxxxxx.xxx	predictive	Medium
135	File	xxxxxxxxxxxx.xxx	predictive	High
136	File	xxxxxxxxxx/xxx/xxxxxx_xxxx.xxx	predictive	High
137	File	xxxxxxxx.xxx.xxx	predictive	High
138	File	xxxxx/xxxxxxxx.x	predictive	High
139	File	xxxxxx.x	predictive	Medium
140	File	xxxxxxxxx/xxxxxx.xxx.xxx	predictive	High
141	File	xxxxxxx/xxx_xxxxxxxx.x	predictive	High
142	File	xxxxxxxx.xxx	predictive	Medium
143	File	xxxxx.xxx	predictive	Medium
144	File	xxxxx.xxx	predictive	Medium
145	File	xxxxxx/xxxxxxx/xxxxxx_xxxxxxxx.xxx	predictive	High
146	File	xxxxxxxxxxxx.xxx	predictive	High
147	File	xxxxxx_xxxxxx.xxx	predictive	High
148	File	xxxxxxxx_xxxxxxx.xxx	predictive	High
149	File	xxxxxxxx.xxx	predictive	Medium
150	File	xxxxxxxx/xxxx?xxxxxx=xx	predictive	High
151	File	xxxxxxxx.xx	predictive	Medium
152	File	xx/xxx.x	predictive	Medium
153	File	xx/xxxx_xxxxxx.x	predictive	High
154	File	xx/xxxx.x	predictive	Medium
155	File	xxxxxxxx/xx/xxxxxxx/xxxxxxx.x	predictive	High
156	File	xxxxx/__xxxx_xxxx.xxx	predictive	High
157	File	xxxxxxx/xxxxxxx/xxx_xxxxxxx.x	predictive	High
158	File	xxxxxxx/xxx_xxxxxxxx.xxx	predictive	High
159	File	xxx_xxxxxxxx.xxx	predictive	High
160	File	xxx_xxxxx_xxxx.x	predictive	High
161	File	xxxxx.xxxx	predictive	Medium
162	File	xxx_xx/xxx_xx_xxxxxx.x	predictive	High
163	File	xxx/xxxxxxxxx/xxxxxxxxx_xxxxx.x	predictive	High
164	File	xxx/xxxx/xxxx_xxxx.x	predictive	High
165	File	xxxx_xxxx.xxx	predictive	High
166	File	xxx_xxxxxxxx.x	predictive	High
167	File	xxxx/xxxxx/xxxxxxx/xxxxxxxx.xx	predictive	High
168	File	xxxx.xxx	predictive	Medium
169	File	xxxxx.xxx	predictive	Medium
170	File	xxx_xxxx.xxx	predictive	Medium
171	File	xx.xx	predictive	Low
172	File	xxxxxxxx/xxxxxxx/xxx/xxxxxxx	predictive	High
173	File	xxxxxxx_xxxxxxx/xxxxxxx/xxxxx_xxxxxxxxx.xxx	predictive	High
174	File	xxxxx.xxx	predictive	Medium
175	File	xxxxxx.xxx	predictive	Medium
176	File	xxxxxx/xxxxxxx-xxx-xxx	predictive	High
177	File	xxxxxxxxx.xxx.xxx	predictive	High
178	File	xxx	predictive	Low
179	File	xxxxxxx.xxx	predictive	Medium
180	File	xxxxxxxxxx.xxx.xxx	predictive	High
181	File	xxxxxxxx	predictive	Medium
182	File	xxxxxxx/xxxxx/xxxxx-xxxxxxxxx.x	predictive	High
183	File	xxxxxxxx.xx	predictive	Medium
184	File	xxxxx.xxx	predictive	Medium
185	File	xxxx.xxx	predictive	Medium
186	File	xxxxxxx/xxxxx/xxxx.xxx	predictive	High
187	File	xxxxxxx.xxx	predictive	Medium
188	File	xxxxxxxxxxxxx.x	predictive	High
189	File	xxxxxx/xxxxx.xxx	predictive	High
190	File	xxxxxxxxx.xxx	predictive	High
191	File	xxxx.xxx	predictive	Medium
192	File	xxxxx.xxx	predictive	Medium
193	File	xxxxxxxx.xxx	predictive	Medium
194	File	xxxxxxxxxx.xxx	predictive	High
195	File	xxxxxxxx.xxx	predictive	Medium
196	File	xxxxxxxxxxxx.xxx	predictive	High
197	File	xxxxxxxx_xxxx.xxx	predictive	High
198	File	xxxxxxxxxx.xxx	predictive	High
199	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	High
200	File	xxx.xxx	predictive	Low
201	File	xxxxxx.xxx	predictive	Medium
202	File	xxxxxx_xxxxxxx.xxx	predictive	High
203	File	xxxxxx_xxx_xxxxxx.xxx	predictive	High
204	File	xxxx_xxxxxxxxx.xxx	predictive	High
205	File	xxxxx.xxx	predictive	Medium
206	File	xxxxx/xxxxx.xxx	predictive	High
207	File	xxxx_xxxxxxx_xxxxxxxx.xxx	predictive	High
208	File	xxxx/xxxxx/xxxxxxx/xxxxxxx.xxx	predictive	High
209	File	xxx/xxxxxxx/xxxxxxxxx/xxxxxx-xxxxxx-xxxxxx.x	predictive	High
210	File	xxxxxxxxxx.xxx	predictive	High
211	File	xxxxxxxxx.xxx	predictive	High
212	File	xxxxxxx-xxxxx.xxx	predictive	High
213	File	xxxxxxx_xxxxx.xxx	predictive	High
214	File	xxxxxxxxxxxxxx.xxx	predictive	High
215	File	xxx.xxx	predictive	Low
216	File	xxxxxx\xxxxxxxx\xx_xxxxx_xxxxxxx.xxx	predictive	High
217	File	x/xxxxx.xxx	predictive	Medium
218	File	xxxxxxxxx/xxxxx/xxxx/xxx_xxxxxxx/xxxxxxx/xxxxxxx.xxx	predictive	High
219	File	xxxx-xxxxxxxx.xxx	predictive	High
220	File	xxxx-xxxx_xxxx_xxxxxxx.xxx	predictive	High
221	File	xxxx-xxxxx.xxx	predictive	High
222	File	xxxx-xxxxxxxx.xxx	predictive	High
223	File	xxxxxxxxxx.xxxxx	predictive	High
224	File	xxxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxx	predictive	High
225	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
226	File	xxxxxx.xxx	predictive	Medium
227	File	xxxxx.xxxxxxxxxx	predictive	High
228	File	xxxxx.xxx	predictive	Medium
229	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	High
230	File	xxxx/xxxxxxxx/xxxxxxxx.xxxx	predictive	High
231	File	xxxxxxxxx.xx	predictive	Medium
232	File	xxxx_xxxxx.xxx	predictive	High
233	File	xxxxxxxxxxxx.xxx	predictive	High
234	File	xxx.xxx	predictive	Low
235	File	xxxxxxxx/xxxxx/xxxxx.xxx	predictive	High
236	File	xxx_xxxxx.xxx	predictive	High
237	File	xx-xxxxxxxx/xxxx.xxx	predictive	High
238	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
239	File	xx-xxxxx.xxx	predictive	Medium
240	File	xx/xx/xxxxx	predictive	Medium
241	File	xxx/xx_xxx.xxx	predictive	High
242	File	xxxxxxx_xxxxxxx.xxx	predictive	High
243	File	xxxxxx.xx	predictive	Medium
244	File	xxxx.xx	predictive	Low
245	File	xxxxxxxxxxx.xxx	predictive	High
246	File	xx_xxxxx/xxxxxx/xxxxxxx/xxx/xxxxxx_xxxxxxx.xxx	predictive	High
247	File	xxxxxxx	predictive	Low
248	File	\xxxxxxx\xxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
249	File	{xxxxxxx}/xxx/xxxxxxx.xxx	predictive	High
250	File	~/.xxx_xxxxxxxxxxx	predictive	High
251	File	~/xxx-xxx-xxxxxx.xxx	predictive	High
252	File	~/xxxxxx/xxxxxxxx.xxx	predictive	High
253	File	~/xxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
254	File	~/xxxxx/xxxxxx-xxxxxxxxx.xxxx.xxx	predictive	High
255	Library	/xxxxxx/xxxxxxx/xxxx.xxx	predictive	High
256	Library	xxxxxxxx_xxxxxxxxx.xxx.xxx	predictive	High
257	Library	xxxxx.xxx	predictive	Medium
258	Library	xxxxxx.xxx	predictive	Medium
259	Library	xxx/xxxxxxx.xx	predictive	High
260	Library	xxxxxx.xxx	predictive	Medium
261	Library	xxxxxxxxxx.xxx	predictive	High
262	Library	xxxxxxxxxxx.xxx	predictive	High
263	Library	xxxxxxxxx.xxx	predictive	High
264	Library	xxxxxx.xxx	predictive	Medium
265	Library	xxxxx.xxx	predictive	Medium
266	Library	xxxxxxxxx.xxx	predictive	High
267	Argument	$xxxx	predictive	Low
268	Argument	$x_xxxxxx[xxxxxxxx]	predictive	High
269	Argument	--xxxxxxx	predictive	Medium
270	Argument	-x	predictive	Low
271	Argument	xxx_xxxx	predictive	Medium
272	Argument	xxxxx_xxx	predictive	Medium
273	Argument	xx	predictive	Low
274	Argument	xxxxxx_xxxx	predictive	Medium
275	Argument	xxxxxxxx	predictive	Medium
276	Argument	xxxx_xxx	predictive	Medium
277	Argument	xxxx/xxxx	predictive	Medium
278	Argument	xxxxxx	predictive	Low
279	Argument	xxx_xxx	predictive	Low
280	Argument	xxx	predictive	Low
281	Argument	xxxxxxxxxx	predictive	Medium
282	Argument	xxx_xx	predictive	Low
283	Argument	xxx[xxxxxx][xxxxxxxxx]	predictive	High
284	Argument	xxx	predictive	Low
285	Argument	xxxxxxx	predictive	Low
286	Argument	xxxxxxxxxxxx	predictive	Medium
287	Argument	xxxx	predictive	Low
288	Argument	xxxxxxx	predictive	Low
289	Argument	xxxxxxxxxxx/xxxxx/xxxxxxxxxxxxxx/xxxxxxxxxxxx	predictive	High
290	Argument	xxxxxx/xxxxxxx	predictive	High
291	Argument	xxxxxxxxxx	predictive	Medium
292	Argument	xxxxxxx	predictive	Low
293	Argument	xxxxxxx-xxxxxx	predictive	High
294	Argument	xxxxxx	predictive	Low
295	Argument	xxxxxxx xxxxxx	predictive	High
296	Argument	xxxxxx_xx	predictive	Medium
297	Argument	xxx_xxxxxxxx	predictive	Medium
298	Argument	xxxxxxxxxxxxxxxx	predictive	High
299	Argument	xxxx_xxx	predictive	Medium
300	Argument	xxxxxxxxxxx	predictive	Medium
301	Argument	xxxx xx xxxxxxx	predictive	High
302	Argument	xxxxxx	predictive	Low
303	Argument	xxxxxxx	predictive	Low
304	Argument	xxxxxxxx	predictive	Medium
305	Argument	xxx	predictive	Low
306	Argument	xxx_xxxx	predictive	Medium
307	Argument	xxxxxxx	predictive	Low
308	Argument	xxxxx	predictive	Low
309	Argument	xxxxx	predictive	Low
310	Argument	xxxxx xxxx	predictive	Medium
311	Argument	xxxx	predictive	Low
312	Argument	xxxxxxxx	predictive	Medium
313	Argument	xxxxxxxxxx	predictive	Medium
314	Argument	xxxxx xxxx	predictive	Medium
315	Argument	xxxxxxxxx/xx/xxxxxxxx	predictive	High
316	Argument	xxxxxxxxxxxxxx[xxxxxxxxxxxxxxxxxx]	predictive	High
317	Argument	xxxxxxxx	predictive	Medium
318	Argument	xxxx	predictive	Low
319	Argument	xxxxxx-xxxxxxx[xxxxxxxx-xxxxxxxxx]	predictive	High
320	Argument	xxx-xxx-xxxx	predictive	Medium
321	Argument	xxxx/xxxx	predictive	Medium
322	Argument	xxxx	predictive	Low
323	Argument	xx	predictive	Low
324	Argument	xx	predictive	Low
325	Argument	xxx	predictive	Low
326	Argument	xxx_xx	predictive	Low
327	Argument	xxxxx.xxx?xxxxxx=xxx_xxxxxxx/xxxx=xxxxxxx/xx=x/xxxxxxxx=xxxxx	predictive	High
328	Argument	xxx	predictive	Low
329	Argument	xxxxxxxxx	predictive	Medium
330	Argument	xxxx_xxxx	predictive	Medium
331	Argument	xxxxxxxxxx	predictive	Medium
332	Argument	xxx	predictive	Low
333	Argument	xxxxxxx	predictive	Low
334	Argument	xx	predictive	Low
335	Argument	xxxx	predictive	Low
336	Argument	xxxxx_xxx	predictive	Medium
337	Argument	xxxxxxx	predictive	Low
338	Argument	xxxxxxx	predictive	Low
339	Argument	xxxxxxxx	predictive	Medium
340	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	High
341	Argument	xxxx/xxxxxxxxxxx	predictive	High
342	Argument	xxxx[]	predictive	Low
343	Argument	xxxx_xx	predictive	Low
344	Argument	xxxxx	predictive	Low
345	Argument	xx	predictive	Low
346	Argument	xxx	predictive	Low
347	Argument	xxxxxx_xxxxxx[xxxxxx_xxxx]	predictive	High
348	Argument	xxxxx xxxxxx	predictive	Medium
349	Argument	xxxxxx	predictive	Low
350	Argument	xxxxx	predictive	Low
351	Argument	xxxxx/xxxxxxx	predictive	High
352	Argument	xxxxxxxxxxxxxxxx	predictive	High
353	Argument	xxxx	predictive	Low
354	Argument	xxxxxxxx	predictive	Medium
355	Argument	xxxx	predictive	Low
356	Argument	xxxxxxxxx	predictive	Medium
357	Argument	xxxxxxxxxx	predictive	Medium
358	Argument	xxxxxxxxx	predictive	Medium
359	Argument	xxxxxxx_xxx	predictive	Medium
360	Argument	xxx	predictive	Low
361	Argument	xxxx_xxxx/xxxxx_xxxx	predictive	High
362	Argument	xxxx_xx	predictive	Low
363	Argument	x_xx	predictive	Low
364	Argument	xxxxxxxx_xx	predictive	Medium
365	Argument	xxx_xxx	predictive	Low
366	Argument	xxxxxxxx	predictive	Medium
367	Argument	xxxxxxxx	predictive	Medium
368	Argument	xxxxxxx_xxx	predictive	Medium
369	Argument	xxx_xxx	predictive	Low
370	Argument	xxxxxx_xxx/xxxxxxx_xxxx/xxxxxxx_xxxx/xxxxxxxxx_xxxxxx	predictive	High
371	Argument	xxxxxx	predictive	Low
372	Argument	xxxxxx_xx	predictive	Medium
373	Argument	xxxxxx_xxxxx	predictive	Medium
374	Argument	xxxxxxxx_xxxxxx	predictive	High
375	Argument	xxxxxx xxxxxxxxxxx/xxxx/xx/xx/xxxxxx xxxx/xxxxxx xxxxxxxx	predictive	High
376	Argument	xxxxxxx_xx	predictive	Medium
377	Argument	xxxx_xxxxxx	predictive	Medium
378	Argument	xxx_xxxx/xxx_xxxxx	predictive	High
379	Argument	xxxxxxxxx	predictive	Medium
380	Argument	xxxxxx	predictive	Low
381	Argument	xxxx	predictive	Low
382	Argument	xxxxxxxxx	predictive	Medium
383	Argument	xxxx/xxxxxx/xxxxxxx/xxxxxxxxxx	predictive	High
384	Argument	xxxxxxx	predictive	Low
385	Argument	xxxxxxx/xxxxxx	predictive	High
386	Argument	xxxxxx	predictive	Low
387	Argument	xxxxxx	predictive	Low
388	Argument	xxx	predictive	Low
389	Argument	xxxxxxx[]	predictive	Medium
390	Argument	xxx	predictive	Low
391	Argument	xxxx	predictive	Low
392	Argument	xxxxx	predictive	Low
393	Argument	xxx	predictive	Low
394	Argument	xxx	predictive	Low
395	Argument	xxxx	predictive	Low
396	Argument	xxxx	predictive	Low
397	Argument	xxxxxxxx	predictive	Medium
398	Argument	xxxxxxxx/xxxxxxxx	predictive	High
399	Argument	xxxx_xx	predictive	Low
400	Argument	xxxx_xxxx	predictive	Medium
401	Argument	xxxx	predictive	Low
402	Argument	xxx_xxxxx	predictive	Medium
403	Argument	xx	predictive	Low
404	Argument	xxxxxx_xxxxx	predictive	Medium
405	Argument	xxxx	predictive	Low
406	Argument	xx_xxxxx_xxxxxxxx	predictive	High
407	Input Value	'\|\|x=x#	predictive	Low
408	Input Value	.%xx.../.%xx.../	predictive	High
409	Input Value	..	predictive	Low
410	Input Value	../	predictive	Low
411	Input Value	/../	predictive	Low
412	Input Value	x\"><xxxxxx>xxxxx(x)</xxxxxx>	predictive	High
413	Input Value	<xxxxxx>xxxxx(x)</xxxxxx>	predictive	High
414	Input Value	x' xxxxx xxxxx(x) xxx 'xxxx'='xxxx	predictive	High
415	Input Value	xxxx	predictive	Low
416	Input Value	\xxx../../../../xxx/xxxxxx	predictive	High
417	Pattern	x\|xx\|x\|xx\|_\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|	predictive	High
418	Pattern	\|xx xx\|	predictive	Low
419	Network Port	xxx/xxx	predictive	Low
420	Network Port	xxx/xxxx (xxx)	predictive	High
421	Network Port	xxx/xxxx	predictive	Medium

References (37)

The following list contains external sources which discuss the actor and the associated activities:

Samples (1)

The following list contains associated samples:

https://services.global.ntt/en-us/insights/blog/discovering-a-new-agent-tesla-malware-sample

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!