Agent Tesla malware upgraded with new modules

mood · Apr 17, 2020

Hackers steal WiFi passwords using upgraded Agent Tesla malware
April 16, 2020
https://www.bleepingcomputer.com/ne...passwords-using-upgraded-agent-tesla-malware/

Some new variants of the Agent Tesla info-stealer malware now come with a dedicated module for stealing WiFi passwords from infected devices, credentials that might be used in future attacks to spread to and compromise other systems on the same wireless network.

The new samples are heavily obfuscated and are designed by the malware's author to collect wireless profile credentials from compromised computers by issuing a netsh command with a wlan show profile argument for listing all available WiFi profiles.

"In addition to wifi profiles, the executable collects extensive information about the system including FTP clients, browsers, file downloaders, machine info (username, computer name, OS name, CPU architecture, RAM) and adds them into a list," Malwarebytes' report says.
Click to expand...

Malware with keylogging and RAT features
Agent Tesla is a commercially available .Net-based info-stealing program with keylogging and remote access Trojan (RAT) capabilities active since at least 2014.

The info-stealer can also be used for collecting system information, for stealing clipboard contents data from the clipboard, and for killing running analysis processed and antivirus solutions.
Click to expand...

Malwarebytes: New AgentTesla variant steals WiFi credentials

AgentTesla is a .Net-based infostealer that has the capability to steal data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. The actor behind this malware is constantly maintaining it by adding new modules. One of the new modules that has been added to this malware is the capability to steal WiFi profiles.

AgentTesla was first seen in 2014, and has been frequently used by cybercriminals in various malicious campaigns since. During the months of March and April 2020, it was actively distributed through spam campaigns in different formats, such as ZIP, CAB, MSI, IMG files, and Office documents.
Popular stealer looking to expand
Since AgentTesla added the WiFi-stealing feature, we believe the threat actors may be considering using WiFi as a mechanism for spread, similar to what was observed with Emotet. Another possibility is using the WiFi profile to set the stage for future attacks.
Click to expand...

Log in or Sign up

Agent Tesla malware upgraded with new modules

mood Updates Team

April 2020’s Most Wanted Malware: Agent Tesla Remote Access Trojan Spreading Widely

New Wiper Malware impersonates security researchers as prank

Loda Trojan revitalized with stealthy upgrade, new exploits

New JhoneRAT Malware Targets Middle East

New Legion Loader Delivers a Variety of Malware

Log in or Sign up

Agent Tesla malware upgraded with new modules

mood Updates Team

April 2020’s Most Wanted Malware: Agent Tesla Remote Access Trojan Spreading Widely

New Wiper Malware impersonates security researchers as prank

Loda Trojan revitalized with stealthy upgrade, new exploits

New JhoneRAT Malware Targets Middle East

New Legion Loader Delivers a Variety of Malware

Useful Searches