Mirrors
/
Gi7w0rm-MalwareConfigLists
mirror of https://github.com/Gi7w0rm/MalwareConfigLists
10
0
Fork 0
Code Issues Releases Wiki Activity

Create ReadMe.md

This commit is contained in:
Gi7w0rm 2023-06-28 18:58:30 +02:00 committed by GitHub
parent b425e52665
commit 6546de8bca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
AgentTesla/ReadMe.md Normal file
View File

@ -0,0 +1,17 @@
# AgentTesla
AgentTesla is a long known threat in the cybersecurity space. The malware has been analysed and discussed in many occasions.
For an overview on this threat check out:
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Sadly, many different builders of AgentTesla have been leaked to the public, enabling many different actors to make use of it.
This repo contains lists of C2 servers used by AgentTesla actors during the last years.
# Some hints on how to read this repo:
## Email_C2_Accounts_list.csv
This file contains information on known SMTP C2 servers used by AgentTesla Actors. Be aware that the original file also contains usernames and passwords for the mentioned SMTP servers. However as many of them are compromised company servers, I will not publish those. Feel free to reach out to me if you find your SMTP server in this list and I can help you identify the compromised entity.
## FTP_C2_account_list.csv
This file contains information on known FTP servers used as AgentTesla C2s. Again, the original malware config contains username and password for those servers, but it has to be assumed many of those FTPs are compromised. Feel free to reach out to me if you find your FTP server in this list and I can help you identify the compromised entity.
## Telegram_C2_Bot_Tokens.txt
Historic and current telegram bots used as AgentTesla C2s.
If you see a query to https://api.telegram.org/[TOKEN]/ in your network, you probably want to have a closer look at the host sending the query.