This malware abuses Tor and Telegram infrastructure to evade detection Skull and Bones
For more than seven years, the Agent Tesla family of remote access trojan (RAT) malware has remained one of the most common threats to Windows users online as it is continually updated by its creators.
A variety of cybercriminals leverage the malware to steal user credentials and other information through screenshots, keylogging and clipboard capture. However, as Agent Tesla’s compiler hard-codes operator-specific variables when its built, the malware’s behavior can vary widely as it continues to evolve.
According to Sophos, recent changes to the malware increased the number of applications targeted for credential theft to include web browsers, email clients, VPN clients and other software that stores usernames and passwords.
SophosLabs has tracked multiple threat actors using Agent Tesla and as of December of last year, it accounted for 20 percent of malicious email attachments detected in the company’s customer telemetry.
Agent Tesla v3
In its new report on Agent Tesla, Sophos sheds further light on two currently active versions of the malware identified as version 2 and version 3 to show how the RAT has evolved by using multiple types of defense evasion and obfuscation to avoid detection.
While both versions of the malware can be configured to communicate over HTTP, SMTP and FTP, version 3 adds the Telegram chat protocol as an option so that attackers can exfiltrate stolen data to a private Telegram chat room.
At the same time, Agent Tesla v3 also allows an attacker to decide whether or not they wish to deploy a Tor client to conceal their communications and this version of the malware can even steal the contents of the Windows system clipboard.
As malicious spam is the most common delivery method for Agent Tesla, Sophos recommends that organizations and individuals treat email attachments from unknown senders with caution and verify the integrity of attachments before opening them.
For more than seven years, the Agent Tesla family of remote access trojan (RAT) malware has remained one of the most common threats to Windows users online as it is continually updated by its creators. A variety of cybercriminals leverage the malware to steal user credentials and other information through…
