Agent Tesla

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Type
Trojan
Origin
Likely Turkey
First seen
1 January, 2014
Last seen
30 September, 2020
Global rank
2
Week rank
2
Month rank
1
IOCs
16629

What is Agent Tesla malware?

Agent Tesla is a password stealer spyware that has been around since 2014. The malware can be used by attackers to spy on victims, allowing them to see everything that has been typed in supported programs and web-browsers.

Being marketed and sold on its own website, which falsely claims that the program is a legitimate keylogger created for personal use, Agent Tesla virus has become extremely popular in the hacker community. Not lastly due to its ease of use and tech support, available on the “official” website where this malware is being sold by the attackers, as well as on the dedicated Discord server. Despite claiming legitimacy of the software, support staff gives advice on utilizing the virus illegally. It is thought that Agent Tesla spyware has originated in Turkey.

General description of Agent Tesla

The spyware is created using .Net software framework. It is aimed at stealing personal data and transmitting it back to the C2 server. The malware is able to access information from web browsers, email clients and FTP servers.

In addition, Agent Tesla malware is able to capture screenshots and videos. It can also record clipboard information and form values. The virus was being distributed on agenttesla-dot-com where attackers could purchase it for as little as 15$. However, depending on the requested options the package price could easily reach roughly 70$.

Uniquely, creators of the malware have set up a sort of an ecosystem around the program, providing 24/7 customer support as well as pre-matched purchase plans that include various options tailored for different budgets and goals. The virus is supplied with a dedicated builder that has a simple-to-use control panel. It allows even a non-technically savvy attacker to pack the payload into a malicious document. What’s more, after 2015 the control panel of Agent Tesla has been expanded with extensive automation functionality, allowing the attacker to automatically capture snapshots or remotely activate the webcam on a victim’s PC in set intervals.

The malware comes equipped with multiple persistence mechanisms that help it avoid antivirus detection. As such, it can resume operation automatically after a system reboot. It is also able to turn off Windows processes to stay hidden.

Malware analysis of Agent Tesla

Interactivity of ANY.RUN allows tracking activities in real-time and watching Agent Tesla in action in a controlled, safe environment with full real-time access to the sandbox simulation. A video recorded by the ANY.RUN gives us the ability to take a closer look at the lifecycle of this virus.

agent tesla execution process graph Figure 1: A lifecycle graph generated by ANY.RUN

How to avoid infection by Agent Tesla?

Agent Tesla malware is not an easy one to detect. The most robust way to stay safe is to exhibit caution when opening suspicious emails or visiting unknown links. Above all, one must be careful to download attachments in emails from unknown senders.

Distribution of Agent Tesla

The malware is distributed at large via spam email campaigns. It is usually delivered to victims in malicious documents, or via malicious web-links. Upon visiting such a link, a contaminated document will be automatically downloaded to a victim’s PC.

If opened, the document will trigger the download of the actual virus. The spyware saves itself in “%temp%” folder and then automatically executes. Email campaigns usually target individuals working in different industries. Topics of malicious emails can be extremely diverse.

Agent Tesla execution process

Agent Tesla keylogger is mostly spread via Microsoft Word documents that contain an embedded executed file or exploit. Once clicked, an executable file is downloaded and renamed. The downloaded file runs itself and creates a child process which in turn can create another child process.

The malware is able to use Regsvcs and Regasm to proxy the code execution through a trusted Windows utility. In the given example RegSvcs.exe process is stealing the personal data.

process tree of the agent tesla execution Figure 2: A process tree of the Agent Tesla execution

Since the main purpose of Agent Tesla RAT is stealing personal information you can define it by behavioral activities. To do so take a look at the indicators of a malicious process (most often its an injected "RegAsm.exe"). If there are the indicator "Actions looks like stealing of personal data" in "Process details" section you probably are dealing with the Agent Tesla trojan. Also, you can view what information the malware has stolen by clicking on the indicator. You can navigate through by clicking right and left arrows in the appeared window.

How to get more Agent Tesla data using ANY.RUN?

Often Agenttesla packets encryption unsuccessful and with ANY.RUN's "Network Stream" analysts can take a look at what data this malware stole. To do it open "Connections" tab in the lower part of the task's window and simply click on the connection which sent data. Not unusual that you can find inside this information even attacker’s SMTP credential.

agent tesla's network stream without encryption Figure 2: Agent Tesla’s Network stream without encryption

Conclusion

According to available information, since its creation, Agent Tesla trojan has been used by over 6,300 customers. Unfortunately, the popularity of the virus is only continuing to rise. The upward trend is of, course, supported by the ease of use which allows even novice attackers to set up attacks.

A company-like service provided by the virus creators also plays a significant role. The danger of Agent Tesla lies not only in the fact that it can be used by almost anybody but also in its ability to open doors to more destructive viruses. Thankfully, interactive analysis services such as ANY.RUN allows professionals to examine the malware behavior in detail and set up appropriate security responses.

IOCs

IP addresses
204.11.56.48
198.54.121.239
206.221.182.74
101.0.117.115
203.124.44.88
89.37.143.80
103.15.48.240
209.99.40.222
148.163.124.15
198.54.114.249
98.142.108.42
98.142.108.42
5.250.252.140
5.250.252.140
5.250.252.140
85.187.154.178
67.20.76.95
66.147.239.119
185.26.106.194
142.93.110.250
Hashes
6fcca7d4771894d9ef0df099f61eba0e2c4a6f46a3aa316829e2ff67e133e958
8bd54fdcad070997915f4a6dfa945f13f84f98adec76849087add2251417703c
013673b59fee90117af775d9edaee5892548013b120a526ebf992b1e19fcbc1a
98c79b72a2e5d25f4023fc2c6000983e9534c590b80a0bb2810d0b56c24e7b43
8715c56ffa7a44e7e01e022fbbe65a09cf11b18de43910dfb731db3e019e60e6
32204b5ccc2a9cd9f1938eedcabd60a3b64d1e6445f1aae6a3681f0f45459ccd
d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627
fafe047ac02dedab03a83a05cf5dc2d073b7aa1c6821a0005b513e63f2df8e3a
0c2bb30542c1eccedf03c4d33aeed1351ef6415397d90f63a42f3b78a0371516
369c056ea9a038f6edea8360c88a6149cc4b61d96f08280ee71176c0852ee85a
8460f094293c03a18ceb6c57ac1d3073696a2865033462d8006b8b6b1033f76a
5baf6fa0f9577d2dc78c35110f4e78c67327730d11b911dc5df8b106e261c326
edd785ba3d76f2c34b755330e0b807713c7ec7fcce923d0fb9dbfc0d21b23565
c8f0aa7ba50490d09c8e02ca50803029a1aa955a07436513e1fc909835f64bf5
fa094ea936fc71578f0d86b3a8b7cfb0f6f18dad451770757c2037f5d518b1b8
15f72b358d4aa03199a030d46ac16292ffe0f14bb4a0f29fe16ec9b58ab469d0
c354ee433d2efc3ac8d55cc1e011a91164866f5ca4b4c7cc04d076975d05d4d0
f0d2d161db6ee348d40d6f1061048bae07cfd32fb7638eaf65371af1576954be
96de7c2b0b158cc2387824fe30d419c32dd5939e7a243bd4ce6f187a5dcf4c4c
d1e95dd90e65fbc86f4f4888487e8fa598fa5f6a1874c091271ee765b216af11
Domains
www.x0c.com
slower.it
89gospel.com
www.petsfan.com
moveonnews.com
myleftheart.com
metrotermhealth.org
musk-giveaway.com
mail.smart-noodles.com
mail.deltataxation.com.au
mail.rastek.net
ftp.adpfr.ro
bookstower.com
majul.com
www.proxyocean.com
mail.mcm.vn
ayudasaudiovisuales.com
ftp.ayudasaudiovisuales.com
ftp.construccionesyaceros.com
toning.zona572.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More
Dharma screenshot
Dharma
dharma ransomware
Dharma is an advanced Ransomware that has been observed in the wild since 2016. It is considered to be the second most profitable RaaS operation by the FBI. The malware targets hospitals and state organizations, encrypts files and demands a payment to restore access to lost information.
Read More