Loading malware…
Agent Tesla, also known as Negasteal, is a Windows spyware and information-stealing trojan discovered in 2014. It is sold through paid subscriptions on cybercriminal underground forums, and its developers continually modify its evasion mechanisms. Distribution methods include phishing emails, malicious spam, and compressed archives, including LZH archives.
Observed variants establish persistence through startup-folder entries and registry-based logon autostart mechanisms. They attempt to evade Microsoft Defender by configuring exclusions or disabling protection. Negasteal has also been used to deliver additional malware: one variant retrieved and decoded Crysis, also known as Dharma, ransomware from a public paste service for fileless delivery. This payload-delivery behavior extends its role beyond spyware, but the file-encryption functionality belongs to the separately delivered ransomware.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Payloads of early versions of the ransomware from June 2021 ... could either be TargetComp ransomware, the Remcos backdoor, the Negasteal malware, or the Snake Keylogger malware.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
According to the sample that we encountered, the variant arrives through a phishing email, as seen in Figure 1.
Using our honeypot, we also found Ukraine-related spam emails that aim to take advantage of the situation via donations and other scams. These spam emails also drop the Ave Maria malware.
For persistence, it adds itself to the startup folder and CurrentVersion\Run.
For persistence, it adds itself to the startup folder and CurrentVersion\Run.
For persistence, it adds itself to the startup folder and CurrentVersion\Run.
For persistence, it adds itself to the startup folder and CurrentVersion\Run.
Fileless delivery also adds a further challenge in removing this threat, as it leaves no trace after execution.
As part of its evasion tactics, it tries to exclude itself from debugging by Windows Defender, which it can also try to disable as a possible alternative evasion method.
These can steal credentials in applications like browsers, simple mail transfer protocol (SMTP), file transfer protocol (FTP), VPNs, and from computer and system information.
Banking trojans and information stealers materialized as the second most prevalent type of cybercrime, with malware families like RedLine, Lumma, LokiBot, Negasteal, and ZBot taking up the top spots.
From the compromised email account, BEC actors can also find email conversations related to finance- or purchase-themed threads such as purchase orders or invoices.
Eventually, the loader will connect to “hastebin[.]com” and decode the binary (Crysis) from the command-and-control (C&C) server
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.