Agent Tesla

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Type
Trojan
Origin
Likely Turkey
First seen
1 January, 2014
Last seen
16 April, 2021
Global rank
2
Week rank
4
Month rank
4
IOCs
20596

What is Agent Tesla malware?

Agent Tesla is a password stealer spyware that has been around since 2014. The malware can be used by attackers to spy on victims, allowing them to see everything that has been typed in supported programs and web-browsers.

Being marketed and sold on its own website, which falsely claims that the program is a legitimate keylogger created for personal use, Agent Tesla virus has become extremely popular in the hacker community. Not lastly due to its ease of use and tech support, available on the “official” website where this malware is being sold by the attackers, as well as on the dedicated Discord server. Despite claiming legitimacy of the software, support staff gives advice on utilizing the virus illegally. It is thought that Agent Tesla spyware has originated in Turkey.

General description of Agent Tesla

The spyware is created using .Net software framework. It is aimed at stealing personal data and transmitting it back to the C2 server. The malware is able to access information from web browsers, email clients and FTP servers.

In addition, Agent Tesla malware is able to capture screenshots and videos. It can also record clipboard information and form values. The virus was being distributed on agenttesla-dot-com where attackers could purchase it for as little as 15$. However, depending on the requested options the package price could easily reach roughly 70$.

Uniquely, creators of the malware have set up a sort of an ecosystem around the program, providing 24/7 customer support as well as pre-matched purchase plans that include various options tailored for different budgets and goals. The virus is supplied with a dedicated builder that has a simple-to-use control panel. It allows even a non-technically savvy attacker to pack the payload into a malicious document. What’s more, after 2015 the control panel of Agent Tesla has been expanded with extensive automation functionality, allowing the attacker to automatically capture snapshots or remotely activate the webcam on a victim’s PC in set intervals.

The malware comes equipped with multiple persistence mechanisms that help it avoid antivirus detection. As such, it can resume operation automatically after a system reboot. It is also able to turn off Windows processes to stay hidden.

Malware analysis of Agent Tesla

Interactivity of ANY.RUN allows tracking activities in real-time and watching Agent Tesla in action in a controlled, safe environment with full real-time access to the sandbox simulation. A video recorded by the ANY.RUN gives us the ability to take a closer look at the lifecycle of this virus.

agent tesla execution process graph Figure 1: A lifecycle graph generated by ANY.RUN

How to avoid infection by Agent Tesla?

Agent Tesla malware is not an easy one to detect. The most robust way to stay safe is to exhibit caution when opening suspicious emails or visiting unknown links. Above all, one must be careful to download attachments in emails from unknown senders.

Distribution of Agent Tesla

The malware is distributed at large via spam email campaigns. It is usually delivered to victims in malicious documents, or via malicious web-links. Upon visiting such a link, a contaminated document will be automatically downloaded to a victim’s PC.

If opened, the document will trigger the download of the actual virus. The spyware saves itself in “%temp%” folder and then automatically executes. Email campaigns usually target individuals working in different industries. Topics of malicious emails can be extremely diverse.

Agent Tesla execution process

Agent Tesla keylogger is mostly spread via Microsoft Word documents that contain an embedded executed file or exploit. Once clicked, an executable file is downloaded and renamed. The downloaded file runs itself and creates a child process which in turn can create another child process.

The malware is able to use Regsvcs and Regasm to proxy the code execution through a trusted Windows utility. In the given example RegSvcs.exe process is stealing the personal data.

process tree of the agent tesla execution Figure 2: A process tree of the Agent Tesla execution

Since the main purpose of Agent Tesla RAT is stealing personal information you can define it by behavioral activities. To do so take a look at the indicators of a malicious process (most often its an injected "RegAsm.exe"). If there are the indicator "Actions looks like stealing of personal data" in "Process details" section you probably are dealing with the Agent Tesla trojan. Also, you can view what information the malware has stolen by clicking on the indicator. You can navigate through by clicking right and left arrows in the appeared window.

How to get more Agent Tesla data using ANY.RUN?

Often Agenttesla packets encryption unsuccessful and with ANY.RUN's "Network Stream" analysts can take a look at what data this malware stole. To do it open "Connections" tab in the lower part of the task's window and simply click on the connection which sent data. Not unusual that you can find inside this information even attacker’s SMTP credential.

agent tesla's network stream without encryption Figure 2: Agent Tesla’s Network stream without encryption

Conclusion

According to available information, since its creation, Agent Tesla trojan has been used by over 6,300 customers. Unfortunately, the popularity of the virus is only continuing to rise. The upward trend is of, course, supported by the ease of use which allows even novice attackers to set up attacks.

A company-like service provided by the virus creators also plays a significant role. The danger of Agent Tesla lies not only in the fact that it can be used by almost anybody but also in its ability to open doors to more destructive viruses. Thankfully, interactive analysis services such as ANY.RUN allows professionals to examine the malware behavior in detail and set up appropriate security responses.

IOCs

IP addresses
198.54.115.24
103.133.105.179
89.42.218.245
148.66.138.106
162.241.85.194
209.99.40.222
204.11.56.48
81.19.215.11
78.198.121.158
101.50.1.12
217.26.70.150
31.186.11.124
103.21.59.27
74.208.5.2
142.93.110.250
212.47.208.136
198.54.121.233
69.16.230.42
199.79.62.21
193.239.84.207
Hashes
702a898f99fdcf56d29f5a9d4c54794c09880f7b000488a1f9f4c2259e520bee
165064cd4b06721491a3d57b5e111faddb9cf6ff0b448b4d5387bb1eb8bb62f2
7f9d55b4ba57eb2fc4ec2e87eb74b9128c521e7da2fa67c74774aa0785eed284
276144fa4171733571ff6940ef10a3bb603028c99c51093d074f6cda0d65afda
8e7a8fe9fde0e6df36a4da7be90995f289342f3187370a089aaca0caba369128
0c52834fc3ba1a3e99c48b75d0387a57c89b2e8a110e15453906837e74eb56a7
8b53497656af5afc2ac7860c1529649e5ce36cf5ffe500c79eaebab1070b83ae
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
5b0eaecfb520d60f1098d11dbed948c154dae6e1c3b767225caa75c8a92532f1
8da67d8ed386a91e3a2fa96b7bc6fcafe5d9e1684db85784aab841bdb59c29e4
589b5319641dce5c7beecee8f7ea6d14d3879beccf1af4eaf888984db3331688
6b67111a129168e5875371886607036c0dfb33afbce0a971c0dc1c7e13047eb1
13ff472515c393678075f24544aa4cc93ca66f90846fa25acb3cf70d254b52c0
731471aa3e46119a04a6776b7cf0f108e4643e00f1f77874c3b0614920092079
10ca968d7f8634c4b1b0f92fdccc652a2c74529257ee1803ea4bc221d69b3a72
57373d1804c561929712b6926ca9b80d928523dc2913678baec4f17bb116fb14
351381f11a5e72b70399481567df8451ca7b72ca2dc3a78b467f71ffc7533bbb
29ebec67d2006c81333565581d8c2b123a3fbeee5123180b25feccb3b02f838e
ef907e837203668def099b394754c3492a9685e5eaa0680778d5b691d45736ab
b8eea246d7d18876f19e6b106abbd6724d692556ad23f886dd50d2cee34d5549
Domains
mail.via-outlookapp.com
www.uniqueinvest.net
tahitihousesitting.com
oficesharapoint.website
mail.nveeusa.com
grab-indonesia.com
rozmata.com
boatshowradio.com
baranacarpet.com
www.perfumela.com
majul.com
modoba.duckdns.org
buffercc.duckdns.org
mail.ireneoptik.ro
smtp.cavannaqroup.com
booking.msg.bluhotels.com
booking.msg.bluhotels.com
mail.tejoofashions.com
mail.lallyautomobiles.net
smtp.clrakmheu.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More
Dharma screenshot
Dharma
dharma ransomware
Dharma is an advanced Ransomware that has been observed in the wild since 2016. It is considered to be the second most profitable RaaS operation by the FBI. The malware targets hospitals and state organizations, encrypts files and demands a payment to restore access to lost information.
Read More