Sophos, a global leader in next-generation cybersecurity, today published new research into Agent Tesla, “Agent Tesla Amps Up Information Stealing Attacks,” which details new evasive techniques attackers are using to disable endpoint protection before they deliver the malware and install and run the payload.
The techniques feature a multi-stage process where a .NET downloader grabs chunks of malware from legitimate third-party websites such as pastebin and hastebin – where they are hosted in plain sight – and then joining, decoding and decrypting the chunks to form the loader that carries the malicious payload.
At the same time, the malware attempts to alter code in Microsoft’s Anti-Malware Software Interface (AMSI) – a Windows feature that enables applications and services to integrate with installed security products – so that AMSI-enabled endpoint security protection doesn’t work, and the payload can download, install and run without being blocked.
Agent Tesla is a widely used information stealer and Remote Access Tool (RAT), known since 2014. The creators advertise it for sale on dark-web forums and constantly update it. Attackers generally distribute the malware through malicious spam emails as an attachment.
The new Sophos research looks in-depth at the two versions of Agent Tesla that are currently circulating. Both feature recent updates, such as the number of applications targeted for credential theft, including web browsers, email clients, virtual private network clients, and other software that store usernames and passwords. They also have the ability to capture keystrokes and record screenshots.
However, differences between the two versions demonstrate how attackers have recently evolved the RAT by employing multiple types of defense evasion and obfuscation to avoid detection. These include options to install and use the Tor anonymizing network client, as well as the Telegram messaging API for command and control (C2) communications and the targeting of Microsoft’s AMSI.
“Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users.It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners,” said Sean Gallagher, senior threat researcher, Sophos. “A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture.
“The most widespread delivery method for Agent Tesla is malicious spam—such as the emails we highlighted in our RATicate research. Sophos believes that cybercriminals will continue to update the malware and modify it to evade endpoint and email protection tools. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organizations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them.”
Recommended IT admin checklist for email security
- Install an intelligent, security solution that can screen, detect and block suspicious emails and their attachments before they reach users
- Implement the recognised authentication standards to verify emails are what they claim to be
- Educate employees to spot the warning signs of suspicious emails and what to do if they encounter one
- Advise users to double check that emails come from the address and the person they claim to
- Advise users to never open attachments or click on links in emails from unknown senders
Sophos endpoint protection, Intercept X, detects Agent Tesla’s installer malware and the RAT itself, both through machine learning and the signatures Troj/Tesla-BE and Troj/Tesla-AW.
Indicators of compromise for Agent Tesla are posted on SophosLabs’ GitHub page.
Further information on Agent Tesla and other cyberthreats is available on SophosLabs Uncut where Sophos researchers regularly publish their latest research and breakthrough findings. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.