Sophos today published new research into Agent Tesla, “Agent Tesla Amps Up Information Stealing Attacks,” which details new evasive techniques attackers are using to disable endpoint protection before they deliver the malware and install and run the payload.
The techniques feature a multi-stage process where a .NET downloader grabs chunks of malware from legitimate third-party websites such as pastebin and hastebin – where they are hosted in plain sight – and then joining, decoding and decrypting the chunks to form the loader that carries the malicious payload.
At the same time, the malware attempts to alter code in Microsoft’s Anti-Malware Software Interface (AMSI) – a Windows feature that enables applications and services to integrate with installed security products – so that AMSI-enabled endpoint security protection doesn’t work, and the payload can download, install and run without being blocked.
The new Sophos research looks in-depth at the two versions of Agent Tesla that are currently circulating. Both feature recent updates, such as the number of applications targeted for credential theft, including web browsers, email clients, virtual private network clients, and other software that store usernames and passwords. They also have the ability to capture keystrokes and record screenshots.
However, differences between the two versions demonstrate how attackers have recently evolved the RAT by employing multiple types of defence evasion and obfuscation to avoid detection. These include options to install and use the Tor anonymizing network client, as well as the Telegram messaging API for command and control (C2) communications and the targeting of Microsoft’s AMSI.
“Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users. It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners,” said Sean Gallagher, senior security researcher, Sophos. “A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture.
“The most widespread delivery method for Agent Tesla is malicious spam—such as the emails we highlighted in our RATicate research. Sophos believes that cybercriminals will continue to update the malware and modify it to evade endpoint and email protection tools. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organizations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them.”
Sophos endpoint protection, Intercept X, detects Agent Tesla’s installer malware and the RAT itself, both through machine learning and the signatures Troj/Tesla-BE and Troj/Tesla-AW.