OXFORD, U.K.  — Febrero 2, 2021 —

Sophos, a global leader in next-generation cybersecurity, today published new research into Agent Tesla, “Agent Tesla Amps Up Information Stealing Attacks,” which details new evasive techniques attackers are using to disable endpoint protection before they deliver the malware and install and run the payload.

The techniques feature a multi-stage process where a .NET downloader grabs chunks of malware from legitimate third-party websites such as pastebin and hastebin – where they are hosted in plain sight – and then joining, decoding and decrypting the chunks to form the loader that carries the malicious payload.

At the same time, the malware attempts to alter code in Microsoft’s Anti-Malware Software Interface (AMSI) – a Windows feature that enables applications and services to integrate with installed security products – so that AMSI-enabled endpoint security protection doesn’t work, and the payload can download, install and run without being blocked.

Agent Tesla is a widely used information stealer and Remote Access Tool (RAT), known since 2014. The creators advertise it for sale on dark-web forums and constantly update it. Attackers generally distribute the malware through malicious spam emails as an attachment.

The new Sophos research looks in-depth at the two versions of Agent Tesla that are currently circulating. Both feature recent updates, such as the number of applications targeted for credential theft, including web browsers, email clients, virtual private network clients, and other software that store usernames and passwords. They also have the ability to capture keystrokes and record screenshots.

However, differences between the two versions demonstrate how attackers have recently evolved the RAT by employing multiple types of defense evasion and obfuscation to avoid detection. These include options to install and use the Tor anonymizing network client, as well as the Telegram messaging API for command and control (C2) communications and the targeting of Microsoft’s AMSI.

“Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users.It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners,” said Sean Gallagher, senior threat researcher, Sophos. “A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture.

“The most widespread delivery method for Agent Tesla is malicious spam—such as the emails we highlighted in our RATicate research. Sophos believes that cybercriminals will continue to update the malware and modify it to evade endpoint and email protection tools. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organizations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them.”

Recommended IT admin checklist for email security

  • Install an intelligent, security solution that can screen, detect and block suspicious emails and their attachments before they reach users
  • Implement the recognised authentication standards to verify emails are what they claim to be
  • Educate employees to spot the warning signs of suspicious emails and what to do if they encounter one
  • Advise users to double check that emails come from the address and the person they claim to
  • Advise users to never open attachments or click on links in emails from unknown senders

Sophos endpoint protection, Intercept X, detects Agent Tesla’s installer malware and the RAT itself, both through machine learning and the signatures Troj/Tesla-BE and Troj/Tesla-AW.

Indicators of compromise for Agent Tesla are posted on SophosLabs’ GitHub page.

Further information on Agent Tesla and other cyberthreats is available on SophosLabs Uncut where Sophos researchers regularly publish their latest research and breakthrough findings. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.

Acerca de Sophos

Sophos es una empresa innovadora y líder mundial de soluciones de ciberseguridad avanzadas, que incluyen servicios de detección y respuesta gestionadas (MDR) y de respuesta a incidentes y un amplio catálogo de tecnologías para endpoint, red, correo electrónico y seguridad en la nube que ayuda a las organizaciones a vencer cualquier ciberataque. Como uno de los mayores proveedores especializados exclusivamente en la ciberseguridad, Sophos protege a más de 500 000 organizaciones y a más de 100 millones de usuarios globalmente de adversarios activos, ransomware, phishing, malware y mucho más. Los servicios y productos de Sophos se conectan a través de su consola de administración de Sophos Central basada en la nube y utilizan Sophos X-Ops, la unidad de información sobre amenazas multidominio de la empresa. La información de Sophos X-Ops optimiza todo el Sophos Adaptive Cybersecurity Ecosystem, que incluye un lago de datos centralizado que se sirve de un completo conjunto de API abiertas disponibles para clientes, partners, desarrolladores y otros proveedores de ciberseguridad y de tecnología de la información. Para las organizaciones que necesitan soluciones de seguridad integrales y totalmente gestionadas, Sophos ofrece la ciberseguridad como servicio. Aunque los clientes también pueden gestionar su ciberseguridad directamente mediante la plataforma de operaciones de seguridad de Sophos o utilizar un enfoque híbrido reforzando sus equipos internos con los servicios de Sophos, que incluyen la búsqueda y remediación de amenazas. Sophos vende a través de partners distribuidores y proveedores de servicios gestionados (MSP) en todo el mundo. Sophos tiene su sede en Oxford, Reino Unido. Encontrará más información en www.sophos.com.