Agent Tesla malware upgraded with new modules

mood · Apr 17, 2020

Hackers steal WiFi passwords using upgraded Agent Tesla malware
April 16, 2020
https://www.bleepingcomputer.com/ne...passwords-using-upgraded-agent-tesla-malware/

Some new variants of the Agent Tesla info-stealer malware now come with a dedicated module for stealing WiFi passwords from infected devices, credentials that might be used in future attacks to spread to and compromise other systems on the same wireless network.

The new samples are heavily obfuscated and are designed by the malware's author to collect wireless profile credentials from compromised computers by issuing a netsh command with a wlan show profile argument for listing all available WiFi profiles.

"In addition to wifi profiles, the executable collects extensive information about the system including FTP clients, browsers, file downloaders, machine info (username, computer name, OS name, CPU architecture, RAM) and adds them into a list," Malwarebytes' report says.
Click to expand...

Malware with keylogging and RAT features
Agent Tesla is a commercially available .Net-based info-stealing program with keylogging and remote access Trojan (RAT) capabilities active since at least 2014.

The info-stealer can also be used for collecting system information, for stealing clipboard contents data from the clipboard, and for killing running analysis processed and antivirus solutions.
Click to expand...

Malwarebytes: New AgentTesla variant steals WiFi credentials

AgentTesla is a .Net-based infostealer that has the capability to steal data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. The actor behind this malware is constantly maintaining it by adding new modules. One of the new modules that has been added to this malware is the capability to steal WiFi profiles.

AgentTesla was first seen in 2014, and has been frequently used by cybercriminals in various malicious campaigns since. During the months of March and April 2020, it was actively distributed through spam campaigns in different formats, such as ZIP, CAB, MSI, IMG files, and Office documents.
Popular stealer looking to expand
Since AgentTesla added the WiFi-stealing feature, we believe the threat actors may be considering using WiFi as a mechanism for spread, similar to what was observed with Emotet. Another possibility is using the WiFi profile to set the stage for future attacks.
Click to expand...

mood · Aug 10, 2020

Upgraded Agent Tesla malware steals passwords from browsers, VPNs
August 10, 2020
https://www.bleepingcomputer.com/ne...-malware-steals-passwords-from-browsers-vpns/

New variants of Agent Tesla remote access Trojan now come with modules dedicated to stealing credentials from applications including popular web browsers, VPN software, as well as FTP and email clients.
No credentials are safe
After analyzing recently collected samples of the infostealer malware, Walter discovered dedicated code used for collecting both app configuration data and user credentials from multiple applications.

"The malware has the ability to extract credentials from the registry as well as related configuration or support files," SentinelOne senior threat researcher Jim Walter explains.
Click to expand...

Google Chrome, Chromium, Safari, Brave, FileZilla, Mozilla Firefox, Mozilla Thunderbird, OpenVPN, and Outlook are just a small sample of all the apps targeted by the latest Agent Tesla RAT variants.

"Current variants will often drop or retrieve secondary executables to inject into, or they will attempt to inject into known (and vulnerable) binaries already present on targeted hosts," Walter also found.
Click to expand...

SentinelLabs: Agent Tesla | Old RAT Uses New Tricks to Stay on Top

Although the Agent Tesla RAT has been around for at least 6 years, it continues to adapt and evolve, defeating many organizations’ security efforts. During the COVID-19 pandemic new variants have been introduced with added functionality, and the malware has been widely used in Coronavirus-themed phishing campaigns.
Click to expand...

mood · Dec 15, 2020

Agent Tesla Keylogger Gets Data Theft and Targeting Update
December 15, 2020
https://threatpost.com/agent-tesla-targeting-data-tactics/162268/

Six-year-old keylogger malware called Agent Tesla has been updated again, this time with expanded targeting and improved data exfiltration features.

Researchers warn that the newest iteration of the malware, disclosed on Tuesday, is likely to add to this volume of attacks, as threat actors move to adopt the updated version.

“Threat actors who transition to this version of Agent Tesla gain the capability to target a wider range of stored credentials, including those for web browser, email, VPN and other services,” said Aaron Riley, cyber threat intelligence analyst with Cofense in a Tuesday analysis.
Click to expand...

Data Exfiltration Tactics
The new version of Agent Tesla includes the ability to target a wider range of stored credentials, such as less popular web browser and email clients.

Agent Tesla now includes the ability to scoop up credentials for the Pale Moon web browser, an Open Source, Mozilla-derived web browser available for Microsoft Windows and Linux; and The Bat email client, an email client for the Microsoft Windows operating system, developed by Ritlabs, SRL.
Click to expand...

Cofense: Strategic Analysis: Agent Tesla Expands Targeting and Networking Capabilities

Agent Tesla has been a major force within the phishing-threat landscape for years and has steadily evolved, likely in response to threat actors’ demands and improvements in network defenses. The variety of infection chains that use this keylogger family as its final payload are too numerous to list, which shows the versatility of this particular family.
Click to expand...

mood · Feb 2, 2021

Agent Tesla ramps up its game in bypassing security walls, attacks endpoint protection
The malware now attempts to disable Microsoft antivirus protection.
February 2, 2021
https://www.zdnet.com/article/agent...g-security-walls-attacks-endpoint-protection/

Agent Tesla malware variants are now using new techniques to try and eradicate endpoint antivirus security.

On Tuesday, Sophos researchers said that two new variants of the Remote Access Trojan (RAT) are targeting Microsoft Anti-Malware Software Interface (AMSI), scanning and analysis software designed to prevent malware infections from taking hold.
Agent Tesla operators will now attempt to tamper with AMSI to degrade its defenses and remove endpoint protection at the point of execution. If successful, this allows the malware to deploy its full payload.
Click to expand...

Target applications include Opera, Chromium, Chrome, Firefox, OpenVPN, and Outlook.

"The differences we see between v2 and v3 of Agent Tesla appear to be focused on improving the success rate of the malware against sandbox defenses and malware scanners, and on providing more C2 options to their attacker customers," the researchers say.
Criminal clients can also choose to maintain persistence by executing the malware on system starts and can remotely uninstall Agent Tesla if they wish.
Click to expand...

Sophos: Agent Tesla amps up information stealing attacks

Recent updates to this common RAT add new communications methods and subvert the operating system’s own defenses
Click to expand...

mood · Jun 21, 2021

Agent Tesla RAT Returns in COVID-19 Vax Phish
June 21, 2021
https://threatpost.com/agent-tesla-covid-vax-phish/167082/

The Agent Tesla remote access trojan (RAT) is scurrying around the internet again, this time arriving via a phishing campaign that uses a COVID-19 vaccination schedule as a lure.

Spotted by researchers at the Bitdefender Antispam Lab, the attackers are targeting Windows machines using emails with malicious attachments. The body of the mails take a business-email approach and ask recipients to review an “issue” with vaccination registration.

“Attached herewith is the revised circular,” the malicious email reads. “There are some technical issues in the registration link provided in the circular yesterday. Kindly refer to the attached link. For those who had successful register earlier, kindly ignore this email.”
Click to expand...

“The updated password-stealing capabilities and security-dodging techniques paired with the malware distribution-as-a-service business model have proven highly profitable,” according to the spokesperson.

In the current spate of attacks, the malicious attachment turns out to be a .RTF document that exploits the known Microsoft Office vulnerability tracked as CVE-2017-11882, a remote code-execution (RCE) bug stemming from improper memory handling. Once opened, the document downloads and executes Agent Tesla malware.

“According to a joint CISA and FBI advisory, CVE-2017-11882 was among the most exploited software vulnerabilities between 2016 and 2019,” according to Bitdefender’s writeup on Friday. “So it seems that bad actors are still hunting for outdated and unpatched software that can easily be compromised.”
Click to expand...

Bitdefender Antispam Lab: Threat Actors Spread Agent Tesla Disguised as COVID-19 Vaccination Registration

A recent phishing campaign targeting Windows machines is attempting to infect users with one of the most recent versions of the Agent Tesla remote access Trojan (RAT).
Click to expand...

mood · Oct 7, 2021

Exclusive: Researchers dumped Gigabytes of data from Agent Tesla C2Cs
October 6, 2021
https://securityaffairs.co/wordpress/123039/malware/agent-tesla-c2c-dumped.html

Agent Tesla, first discovered in late 2014, is an extremely popular “malware-as-a-service” Remote Access Trojan (RAT) tool used by threat actors to steal information such as credentials, keystrokes, clipboard data and other information from its operators’ targets.

Los Angeles-based Resecurity, Inc. and its cyber threat intelligence and R&D unit, HUNTER, drained the Agent Tesla Command & Control Servers (C2) and extracted over 950GB of logs containing compromised Internet users credentials, files and other sensitive information stolen by malicious code. The data extraction was made possible through a collaboration with Resecurity, law enforcement and several ISPs in the European Union, Middle East and North America.

The collected information allowed for the recovery of knowledge about the victims and the timeline of the campaigns conducted by actors leveraging Agent Tesla.
Click to expand...

Researchers found active instances of Agent Tesla and developed a mechanism to enumerate the affected clients and extract compromised data. To share knowledge and encourage information security researchers to combat malicious code, Resecurity’s HUNTER unit has prepared an educational video demonstrating the .NET reverse engineering and deobfuscation techniques used for the Agent Tesla analysis.
Click to expand...

“Successful tracking of Agent Tesla activity allowed for the recovery of critical insights about the victims affected by it globally and the probable threat actors targeting them. In some cases, we saw obvious patterns of cybercriminals. However, we also saw other actors closely affiliated with particular foreign states leveraging this cyberespionage tool due to its availability in underground hacking communities,” said Ahmed Elmalky, an Offensive Cyber Security Researcher at Resecurity, Inc.

According to multiple independent cybersecurity researchers and companies involved in Agent Tesla tracking, this RAT remains a consistent threat for the Microsoft Windows environment and is primarily delivered via e-mail as a malicious attachment.
Click to expand...

Log in or Sign up

Agent Tesla malware upgraded with new modules

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team