Loading malware…
Agent Tesla is a long-running Windows-focused information stealer and remote access malware family commonly distributed in commodity cybercrime campaigns. It is frequently delivered through phishing emails carrying malicious attachments or links, including compressed archives, script-based downloaders, exploit-bearing documents, and OneNote lures. Campaigns associated with Agent Tesla have also used multi-stage loaders, obfuscated PowerShell, steganography, and process hollowing to retrieve and execute the final payload while reducing detection.
Agent Tesla is best known for credential theft and data exfiltration. Reported capabilities include harvesting credentials from web browsers, email clients, FTP software, and application configuration or support files; extracting credentials from the Windows Registry; logging keystrokes; capturing screenshots; collecting clipboard contents; enumerating running processes; gathering the current username and local network information such as the victim IP address and wireless settings; and decrypting protected or obfuscated strings, including Rijndael-encrypted strings used in its own configuration or code paths. Stolen data is commonly exfiltrated through email using SMTP, though delivery chains and surrounding infrastructure vary by campaign.
The malware also supports multiple persistence and evasion mechanisms on Windows systems. Observed techniques include adding itself to Registry autostart locations, modifying Registry keys for persistence, and creating scheduled tasks. Defense-evasion behavior includes hidden window execution and use of process hollowing to run within legitimate processes. Hidden folders have also been observed in some cases.
Agent Tesla is widely used by financially motivated threat actors and appears regularly in broad phishing operations targeting many sectors and geographies rather than a single vertical. Reported campaigns have targeted organizations in regions including Japan, Latin America, North America, Europe, and elsewhere, with lures themed around invoices, payments, shipping, reservations, and other business communications. It is often deployed alongside or in parallel with other commodity malware families such as XWorm, AsyncRAT, Remcos, RedLine, NetWire, and XLoader.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
EML delivers a malicious XLS file; the XLS exploits CVE-2017-0199 to download an HTA script, which then downloads a steganographic image, decrypts and memory-executes a loader, and the loader ultimately executes the AgentTesla family for email-based C2 communication. | After a successful compromise, the group deploys mature remote access trojans and information stealers such as AgentTesla and XWorm on victim endpoints... The two samples analyzed below use AgentTesla and XWorm respectively for command-and-control communication.
The malicious spam messages were crafted to exploit CVE-2017-11882. The remote code execution flaw is specific to Microsoft Word Equation Editor. Once exploited, the Warzone RAT payload is downloaded and installed.
Document.doc implements a second exploit in the chain identified by the following CVEs: CVE-2018-0802, CVE-2017-11882, a memory corruption vulnerability. The content of this new document automatically replaces the content of the original document. While Patches already exist for those vulnerabilities, many endpoints were still unpatched due to operational constraints. | The Agent Tesla information stealer has been around since 2014... The final payload that runs within the RegAsm is the main Agent Tesla Dark Stealer module
A full spectrum of payload delivery mechanisms are seen being employed by the maldocs, including links, macros, DDE commands and Office exploits (e.g. CVE-2017-11882 and CVE-2017-8570). | First seen in 2014, AgentTesla is a .NET platformed stealer that has recently surpassed Emotet and Trickbot to become one of the most prevalent malware threats.
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
Associated Analytic Story AgentTesla CVE-2023-21716 Word RTF Heap Corruption Compromised Windows Host FIN7 PlugX Warzone RAT
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
After a successful compromise, the group deploys mature remote access trojans and information stealers such as AgentTesla and XWorm on victim endpoints... The two samples analyzed below use AgentTesla and XWorm respectively for command-and-control communication.
These campaigns, detailed in our previous report, distributed payloads that included AgentTesla, Formbook, Lokibot, Netwire and Betabot.
In this campaign, malicious PowerPoint Add-in files were used to deliver Agent Tesla and PowerShell cryptocurrency-stealing malware.
Final Payload – Agent Tesla: Below figure shows injected Agent Tesla payload in RegAsm.exe. Agent Tesla is a well-known keylogger and infostealer written in DotNet.
Final Payload – Agent Tesla: Below figure shows injected Agent Tesla payload in RegAsm.exe. Agent Tesla is a well-known keylogger and infostealer written in DotNet.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Sa propagation repose principalement sur des campagnes de phishing distribuant des pièces jointes malveillantes, notamment des documents Microsoft Office, des archives compressées ou des exécutables.
この paste[.]ee から取得された文字列は VBScript によって結合・置換処理されたのち、PowerShell スクリプトとして実行されます。
This is an empty Excel document, whose sheets are hidden. It also contains a password protected VBA project (Macro). | the response from “27.html” contains malicious code, VBScript code for this case... There are three segments of VBScript code
The downloaded file is a JavaScript script... its core logic is designed to invoke and execute a Base64-encoded PowerShell command.
The XLS file in the email attachment exploits CVE-2017-0199. Once opened in an affected version of Office, the vulnerability is triggered and the document automatically downloads and executes malicious content from a remote link.
最後に、_applicationName に指定された C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBUILD.exe を起動し、そのプロセスのメモリ内にデコードした PE ファイルをコードインジェクションし感染させています。
Afin de limiter sa détection, « Agent Tesla » met en œuvre diverses techniques d’obfuscation, d’anti-analyse, d’évasion et d’exécution en mémoire.
The most distinctive characteristic of TA558's recent attack campaigns... is the concealment of malicious PowerShell code or payloads within seemingly innocuous JPG images.
なお、この .vbs という拡張子は、Windows の通常の設定では表示されていないことから、ユーザには 韓国銀行の領収書 というファイルに見えてしまいます。
最後に、_applicationName に指定された C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBUILD.exe を起動し、そのプロセスのメモリ内にデコードした PE ファイルをコードインジェクションし感染させています。
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
Il peut notamment effectuer du keylogging, accéder au contenu du presse-papiers, capturer des captures d’écran et extraire les identifiants et secrets stockés dans les applications ciblées.
Les données collectées sont ensuite exfiltrées vers une infrastructure contrôlée par les attaquants, en s’appuyant notamment sur les protocoles SMTP, FTP, HTTP ou HTTPS.
After completing information theft, the malicious payload uses built-in SMTP credentials to exfiltrate data via email.
the group primarily used the archive.org data platform and the Cloudinary video platform... leveraged legitimate cloud storage services ... as payload distribution channels
1,489 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware delivered via email and targeting Japanese users.
Commodity malware mentioned as possibly related to the crypting actor esco.
A credential-stealing trojan known for harvesting credentials at scale.
Stealer malware family included among the dominant Telegram-based malware samples.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.