Loading malware…
Agent Tesla is a .NET-based information stealer targeting Windows systems, distributed commercially through malware-as-a-service arrangements and frequently described as a remote access Trojan. Its principal functions include credential theft, keylogging, clipboard monitoring, and collection of browser data and system information. It targets saved credentials from browsers, email clients, FTP applications, VPN clients, remote-access tools, and wireless profiles. An analyzed variant supported credential collection from more than 80 applications and also extracted Thunderbird email contacts. Collected information is exfiltrated through mechanisms including SMTP, FTP, and attacker-controlled Telegram bots. Individual builds can disable collection features, so capabilities vary between deployments.
Agent Tesla is primarily delivered through phishing and malicious spam using business proposals, quotations, invoices, purchase orders, shipping documents, and payment notifications as lures. Payloads arrive in archive attachments or through malicious Microsoft Office documents. Observed delivery chains have exploited CVE-2017-0199, CVE-2017-11882, CVE-2018-0802, and the WinRAR vulnerability CVE-2023-38831. Multistage infections commonly employ obfuscated scripts, PowerShell, image-embedded encoded payloads, and in-memory .NET loading. Agent Tesla has been executed inside legitimate Windows processes through process injection and process hollowing.
Its defense-evasion features include code and control-flow obfuscation, debugger detection, security-tool checks, and identification of virtual machines, sandboxes, and hosting environments. Some variants terminate when these checks indicate an analysis environment. System profiling can collect the logged-in username, computer name, operating-system details, processor information, memory capacity, and public network address.
Agent Tesla is used by multiple independent cybercriminal operators rather than a single exclusive threat actor. Documented users include TA558, Nigerian operators tracked under SilverTerrier, and the operator known as Fucosreal. Campaigns have targeted organizations internationally, including manufacturing, government, banking, healthcare, maritime, and other commercial sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Excel document is in OLE format with crafted embedded data that exploits the CVE-2017-0199 vulnerability. It contains an embedded OLE hyperlink, which is opened automatically once the Excel document is started by the victim.
The RTF document has embedded malicious code. It Leverages the Equation Editor Vulnerability (CVE-2017-11882) to trigger the download of the subsequent payloads in the attack chain. The process utilizes the legitimate executable “EQNEDT32.EXE” to initiate the execution of malicious shellcode.
CVE-2023-38831, the WinRAR zero-day remote code execution vulnerability, has been exploited in the wild to distribute several malware families.
The malicious attachment is, in fact, an RTF document exploiting the CVE - 2018-0802 vulnerability. When accessed it will prompt the download of Agent Tesla Malware to the victim’s machine.
Rapid7 is responding to various compromises arising from the exploitation of CVE-2022-47966, a pre-authentication remote code execution (RCE) vulnerability impacting at least 24 on-premise ManageEngine products. CVE-2022-47966 stems from a vulnerable third-party dependency on Apache Santuario.
A full spectrum of payload delivery mechanisms are seen being employed by the maldocs, including links, macros, DDE commands and Office exploits (e.g. CVE-2017-11882 and CVE-2017-8570). | First seen in 2014, AgentTesla is a .NET platformed stealer that has recently surpassed Emotet and Trickbot to become one of the most prevalent malware threats.
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
Associated Analytic Story AgentTesla CVE-2023-21716 Word RTF Heap Corruption Compromised Windows Host FIN7 PlugX Warzone RAT
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
15 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Per the research and analysis blog by Cyren, this sample downloads and installs AgentTesla malware.”
“In March 2024, we discovered a spam campaign targeting our clients which distributed a malicious TAR archive ... This archive contained the Agent Tesla stealer.”
Большинство изученных писем содержали вредоносное программное обеспечение (ВПО) Agent Tesla или Remcos, относящееся к классу Remote Administration Tools (RAT).
“Malware: ... Sherlock, AgentTesla, Remcos, Neutrino, BlackNET, Venom RAT.”
In May 2024, bukky101 delivered a sample of Agent Tesla ... The data was exfiltrated via the attacker's SMTP server at boydjackson[.]org.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon exploiting the successful vulnerability, it leads to BAT file execution, which pretends to be a PDF file.
1,583 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Distributed through phishing emails disguised as business proposal review requests. Recipients are asked to review an attached product list and provide inventory and pricing feedback, enticing them to download and open a ZIP attachment. The excerpt does not describe the malware's capabilities or subsequent execution steps.
An infostealer delivered in emails posing as business and quotation requests from an Indian plumbing company; it uses SMTP to exfiltrate stolen information.
A password-stealing malware family distributed via Italian malspam campaigns during the reporting period.
A password-stealing malware family distributed through malspam campaigns targeting Italy during the reporting week.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.