OXFORD, U.K.  — February 2, 2021 —

Sophos, a global leader in next-generation cybersecurity, today published new research into Agent Tesla, “Agent Tesla Amps Up Information Stealing Attacks,” which details new evasive techniques attackers are using to disable endpoint protection before they deliver the malware and install and run the payload.

The techniques feature a multi-stage process where a .NET downloader grabs chunks of malware from legitimate third-party websites such as pastebin and hastebin – where they are hosted in plain sight – and then joining, decoding and decrypting the chunks to form the loader that carries the malicious payload.

At the same time, the malware attempts to alter code in Microsoft’s Anti-Malware Software Interface (AMSI) – a Windows feature that enables applications and services to integrate with installed security products – so that AMSI-enabled endpoint security protection doesn’t work, and the payload can download, install and run without being blocked.

Agent Tesla is a widely used information stealer and Remote Access Tool (RAT), known since 2014. The creators advertise it for sale on dark-web forums and constantly update it. Attackers generally distribute the malware through malicious spam emails as an attachment.

The new Sophos research looks in-depth at the two versions of Agent Tesla that are currently circulating. Both feature recent updates, such as the number of applications targeted for credential theft, including web browsers, email clients, virtual private network clients, and other software that store usernames and passwords. They also have the ability to capture keystrokes and record screenshots.

However, differences between the two versions demonstrate how attackers have recently evolved the RAT by employing multiple types of defense evasion and obfuscation to avoid detection. These include options to install and use the Tor anonymizing network client, as well as the Telegram messaging API for command and control (C2) communications and the targeting of Microsoft’s AMSI.

“Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users.It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners,” said Sean Gallagher, senior threat researcher, Sophos. “A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture.

“The most widespread delivery method for Agent Tesla is malicious spam—such as the emails we highlighted in our RATicate research. Sophos believes that cybercriminals will continue to update the malware and modify it to evade endpoint and email protection tools. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organizations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them.”

Recommended IT admin checklist for email security

  • Install an intelligent, security solution that can screen, detect and block suspicious emails and their attachments before they reach users
  • Implement the recognised authentication standards to verify emails are what they claim to be
  • Educate employees to spot the warning signs of suspicious emails and what to do if they encounter one
  • Advise users to double check that emails come from the address and the person they claim to
  • Advise users to never open attachments or click on links in emails from unknown senders

Sophos endpoint protection, Intercept X, detects Agent Tesla’s installer malware and the RAT itself, both through machine learning and the signatures Troj/Tesla-BE and Troj/Tesla-AW.

Indicators of compromise for Agent Tesla are posted on SophosLabs’ GitHub page.

Further information on Agent Tesla and other cyberthreats is available on SophosLabs Uncut where Sophos researchers regularly publish their latest research and breakthrough findings. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.

About Sophos

Sophos is a worldwide leader and innovator of advanced cybersecurity solutions, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies that help organizations defeat cyberattacks. As one of the largest pure-play cybersecurity providers, Sophos defends more than 500,000 organizations and more than 100 million users globally from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through its cloud-based Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully-managed, turnkey security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.