Sends compromised data to web panel operated by malicious actors. Though the information-stealing capabilities operate in a similar manner across all forms of communication, the way data is exfiltrated can vary depending on both version of the malware and configuration of a specific sample:Д¬ompromised email accounts are utilized to exfiltrate information to a mail server operated by malicious actors. Most Agent Tesla samples abuse SMTP as their desired communication method. It abuses the popular Instant Messenger (IM) Telegram to communicate with its Command and Control (C2) infrastructure. In Version 3 of the malware, Agent Tesla added an additional form of communication. The threat actor selects this configuration when building a new malicious sample. CommunicationД«oth Version 2 and Version 3 of Agent Tesla can be configured to communicate over HTTP, SMTP, and FTP. Once deployed on a victimвЂ™s device, the malware will initially fingerprint the device to confirm infection, sending this information back to its Command and Control (C2) before carrying out its large magnitude of malicious information stealing capabilities.ДЇigure 19: Network capture of initial SMTP communication. This large degree of flexibility is another reason why the malware is still such a prevalent threat, even years after its initial release. This malware has been observed dropping fromВ weaponized documents that containВ aВ maliciousВ payloadВ that downloads Agent Tesla,В orВ it may deployВ itselfВ via an executableВ emailВ attachment. These lure attachments canВ differ greatly with the aim of generating a click by a potential victim andВ initiating its malicious payload. Email attachmentВ is its most common deployment vector. Infection VectorДЄgent Tesla can be dropped onto a victimвЂ™s machine in a wide array of ways. This latter version also provides the option to use a Tor client to encrypt communications.

Recent variants of Agent Tesla version 3 have been seen abusing the chat platform Telegram. In version 3, each encrypted string has its own function, which makes reverse engineering these static strings more difficult.Д«oth versions of the malware can communicate over HTTP, SMTP, and FTP. In version 2, a single function decrypts all the strings and allows them to be executed. Version 3 вЂ“ Additional customization options, advances in obfuscation and further functionality.Д«oth variants have varying levels of obfuscation.Version 2 вЂ“ First released version of the malware, with a focus on obfuscation and anti-analysis.Paying users would get a sophisticated graphical user interface and a dashboard for management of victim devices, providing ease-of-use for even the most novice of threat actors.Д¬urrently, there are two prominent variants of Agent Tesla still found in-the-wild:

This website offered cybercriminals and threat actors flexible pricing options and fixed term licenses to use the malware. Malware-as-a-ServiceДЄgent Tesla was first available for purchase from an official website agentteslacom. Due to its prevalence, ready availability, and highly sophisticated nature, Agent Tesla has a high impact rating.

Coccoc download continuation