Agent Tesla

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Type
Trojan
Origin
Likely Turkey
First seen
1 January, 2014
Last seen
13 July, 2020
Global rank
2
Week rank
1
Month rank
1
IOCs
14660

What is Agent Tesla malware?

Agent Tesla is a password stealer spyware that has been around since 2014. The malware can be used by attackers to spy on victims, allowing them to see everything that has been typed in supported programs and web-browsers.

Being marketed and sold on its own website, which falsely claims that the program is a legitimate keylogger created for personal use, Agent Tesla virus has become extremely popular in the hacker community. Not lastly due to its ease of use and tech support, available on the “official” website where this malware is being sold by the attackers, as well as on the dedicated Discord server. Despite claiming legitimacy of the software, support staff gives advice on utilizing the virus illegally. It is thought that Agent Tesla spyware has originated in Turkey.

General description of Agent Tesla

The spyware is created using .Net software framework. It is aimed at stealing personal data and transmitting it back to the C2 server. The malware is able to access information from web browsers, email clients and FTP servers.

In addition, Agent Tesla malware is able to capture screenshots and videos. It can also record clipboard information and form values. The virus was being distributed on agenttesla-dot-com where attackers could purchase it for as little as 15$. However, depending on the requested options the package price could easily reach roughly 70$.

Uniquely, creators of the malware have set up a sort of an ecosystem around the program, providing 24/7 customer support as well as pre-matched purchase plans that include various options tailored for different budgets and goals. The virus is supplied with a dedicated builder that has a simple-to-use control panel. It allows even a non-technically savvy attacker to pack the payload into a malicious document. What’s more, after 2015 the control panel of Agent Tesla has been expanded with extensive automation functionality, allowing the attacker to automatically capture snapshots or remotely activate the webcam on a victim’s PC in set intervals.

The malware comes equipped with multiple persistence mechanisms that help it avoid antivirus detection. As such, it can resume operation automatically after a system reboot. It is also able to turn off Windows processes to stay hidden.

Malware analysis of Agent Tesla

Interactivity of ANY.RUN allows tracking activities in real-time and watching Agent Tesla in action in a controlled, safe environment with full real-time access to the sandbox simulation. A video recorded by the ANY.RUN gives us the ability to take a closer look at the lifecycle of this virus.

agent tesla execution process graph Figure 1: A lifecycle graph generated by ANY.RUN

How to avoid infection by Agent Tesla?

Agent Tesla malware is not an easy one to detect. The most robust way to stay safe is to exhibit caution when opening suspicious emails or visiting unknown links. Above all, one must be careful to download attachments in emails from unknown senders.

Distribution of Agent Tesla

The malware is distributed at large via spam email campaigns. It is usually delivered to victims in malicious documents, or via malicious web-links. Upon visiting such a link, a contaminated document will be automatically downloaded to a victim’s PC.

If opened, the document will trigger the download of the actual virus. The spyware saves itself in “%temp%” folder and then automatically executes. Email campaigns usually target individuals working in different industries. Topics of malicious emails can be extremely diverse.

Agent Tesla execution process

Agent Tesla keylogger is mostly spread via Microsoft Word documents that contain an embedded executed file or exploit. Once clicked, an executable file is downloaded and renamed. The downloaded file runs itself and creates a child process which in turn can create another child process.

The malware is able to use Regsvcs and Regasm to proxy the code execution through a trusted Windows utility. In the given example RegSvcs.exe process is stealing the personal data.

process tree of the agent tesla execution Figure 2: A process tree of the Agent Tesla execution

Since the main purpose of Agent Tesla RAT is stealing personal information you can define it by behavioral activities. To do so take a look at the indicators of a malicious process (most often its an injected "RegAsm.exe"). If there are the indicator "Actions looks like stealing of personal data" in "Process details" section you probably are dealing with the Agent Tesla trojan. Also, you can view what information the malware has stolen by clicking on the indicator. You can navigate through by clicking right and left arrows in the appeared window.

How to get more Agent Tesla data using ANY.RUN?

Often Agenttesla packets encryption unsuccessful and with ANY.RUN's "Network Stream" analysts can take a look at what data this malware stole. To do it open "Connections" tab in the lower part of the task's window and simply click on the connection which sent data. Not unusual that you can find inside this information even attacker’s SMTP credential.

agent tesla's network stream without encryption Figure 2: Agent Tesla’s Network stream without encryption

Conclusion

According to available information, since its creation, Agent Tesla trojan has been used by over 6,300 customers. Unfortunately, the popularity of the virus is only continuing to rise. The upward trend is of, course, supported by the ease of use which allows even novice attackers to set up attacks.

A company-like service provided by the virus creators also plays a significant role. The danger of Agent Tesla lies not only in the fact that it can be used by almost anybody but also in its ability to open doors to more destructive viruses. Thankfully, interactive analysis services such as ANY.RUN allows professionals to examine the malware behavior in detail and set up appropriate security responses.

IOCs

IP addresses
5.2.84.160
192.185.129.218
204.11.56.48
192.185.96.18
207.191.38.36
108.163.138.140
67.215.233.7
85.187.154.178
198.54.120.134
198.54.115.130
108.167.183.29
212.47.208.136
208.91.198.225
85.97.148.74
162.241.27.33
198.54.120.244
74.208.5.2
160.153.128.9
34.192.250.175
185.61.153.124
Hashes
e4d88de81b47c673909f4d760aef8dde7e892697486e4778f4ea8bacb7b49daf
75de0a411fad1f468398a8e00c6b95c6a1ee49c5f91bd1c74aef87d61d238eee
32299b31508d3573355dbee08ac526382cd90fbe5026335c5f8917ab34c02177
453ce74080dd725b902d29d9ba2a1fd3d3f100e3986ba11f87812fc9aa7f337c
48d5f821084af643bdfceb5a31011470d2ca2b10027feea1bf64e29495b54cd8
0c2de142e2494073dddba2a5ab5d1155727c3fc7f8c765055bf2cc8411f32f55
9c38ee8e0a3c1c135ec3c4dd93b8ea67c0a39a83f1f4960c219eeb6e12ea66ce
dc9ad489e9749a09227c79e5818fb5f3df9eb460bdc4c17e6d1efbe964b8b12f
9b492c0b8f0a9182f2af3ffe1a6c3e2f149e2554f0b1be1c2293949541efce5d
d2e5fdfd013a4fd426b9455889c8cf4f9102d1e7d68a3f739c4f88353f3778ff
bcfef70a1398972a7536f1d45967e02e204994c04f6049a0a7aba5a44d87af84
72753f6eb976e78a830e2a4c5aa5b2205f15111007b9b20b4beee6c1865a7242
caf1d4f374de0479bc4ca6caa289cfc35720779080a2957aab92ba4fc1602e6c
38227a2fa957e10490fc1413d7d46c5aabfbf40285f487cb1f6a79cba9373c57
de638d68163fe7f49b3371adbe9456b2c2ed2ef5182324e768dc42793591c7de
e47f1419ace154d1aa7057058e82c5cc21326f1e9502328588261cb31eb0a372
ce68522259f7e8dd5e8b7907f896193c44e9a5a1243194d9dfb758a708e7968a
41eb1b14f228c881ea01adc491d19378591d1ea4dffc4e8c7a74953de73faf43
fe0aec403ca2bf42a36bdc2c2cc9267178abeb7e95e8d94b912723555ba3760d
1a833542a69d8d09c66269575771e81866bbfc6a25d697166fbef41a715d6436
Domains
mail.varda.com.tr
shop.definitelykingsley.com
mail.foodanddesign-lb.com
isns.net
internationalantivirussmartscreensecur.duckdns.org
money1234.duckdns.org
ftp.fox8live.com
ftp.southeating.com
smtp.altrii.com
mail.flood-protection.org
flood-protection.org
smtp.rezuit.pro
majul.com
smtp.lokalboyz.com
smtp.mitsublshicorp.com
smtp.knmbz.com
smtp.mazzonettoweb-it.com
smtp.kindehome.com
smtp.autoshorp.com
smtp.group-lem.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More
Dharma screenshot
Dharma
dharma ransomware
Dharma is an advanced Ransomware that has been observed in the wild since 2016. It is considered to be the second most profitable RaaS operation by the FBI. The malware targets hospitals and state organizations, encrypts files and demands a payment to restore access to lost information.
Read More