Agent Tesla stands out as an advanced Remote Access Trojan (RAT) that is often used for malicious purposes. This malware, which functions as both a keylogger and an information stealer, is capable of monitoring user activity, exfiltrating sensitive data, and seriously compromising victims’ security. With an estimated global impact of 3%, it is essential to understand how it works, its capabilities, and its use cases in order to better protect against it.

How the Malware Works: A Well-Oiled Machine

Agent Tesla follows a methodical process to infect systems, establish a foothold, collect data, and exfiltrate it. Here is a detailed analysis of its steps.

1. Initial infection

The starting point of any attack is distribution. Agent Tesla primarily uses phishing campaigns, a method that relies on manipulating users into opening infected attachments or clicking on malicious links.

  • Distribution vectors: Attackers target their victims through fraudulent emails, often disguised as legitimate messages (invoices, bank notifications, COVID-19 updates, etc.).
  • Types of Attachments : These emails contain infected files such as:
    • Office documents (Word, Excel) containing malicious macros.
    • ZIP files containing executable files.
    • PDFs that exploit vulnerabilities in the file reader.

2. Execution and Persistence

Once the file is open, Agent Tesla springs into action:

  • Initial Execution: The malicious code is activated, and the malware silently installs itself on the target machine.
  • Mechanisms of persistence : It ensures that it survives a reboot by:
    • Modifying startup registry keys.
    • Copying its files to critical system directories.

3. Data Collection

Once installed, Agent Tesla begins collecting data:

  • Keylogging: It records keystrokes to capture passwords, usernames, or any other sensitive information.
  • Screenshots: It takes regular screenshots to monitor user activity.
  • Application Monitoring: It monitors data from popular software such as web browsers, email clients (Outlook, Thunderbird), and FTP clients.

4. Data exfiltration

The ultimate goal is to exfiltrate the stolen data to servers controlled by the attackers. To do this, Agent Tesla uses various protocols such as HTTP, SMTP, FTP, or even online services.

AgentTesla Malware Diagram

Diagram illustrating the infection chain of the AgentTesla malware

The advanced features of this malware

Agent Tesla is much more than just a keylogger. Its features make it a formidable and versatile threat:

  1. Keylogger: Captures keystrokes, exposing passwords and sensitive data.
  2. Screenshot: Takes snapshots at regular intervals to monitor activity.
  3. Data exfiltration: Transmits stolen information to the attackers' servers.
  4. Password Theft: Retrieves login credentials stored in web browsers, email clients, and other software.
  5. Clipboard Monitoring: Allows you to capture copied information, such as credit card numbers.
  6. Cryptocurrency Wallet Theft: Targets digital wallets installed on the device.
  7. Antivirus Evasion: Uses advanced techniques to avoid detection by security tools.

Use Cases for the Tesla Agent

Agent Tesla has been used in a variety of scenarios, demonstrating its ability to cause significant damage in a wide range of environments.

1. Phishing campaign targeting a company

  • Background: An employee receives an email that appears to be legitimate, containing an invoice as an attachment.
  • Infection: The malicious macro in the Word document runs Agent Tesla.
  • Consequences: The employee's login credentials are stolen, allowing the attackers to gain access to internal systems.

2. Theft of banking information

  • Background: A user opens a PDF from a fake banking institution.
  • Infection: The PDF exploits a vulnerability to install the malware.
  • Consequences: The user's banking credentials are stolen and used to gain unauthorized access to their accounts.

3. Targeting Healthcare Professionals

  • Background: Emails purportedly sent by organizations such as the WHO ask recipients to download information about COVID-19.
  • Infection: The attached files contain Agent Tesla.
  • Consequences: Patient information and sensitive data from healthcare systems are compromised.

How can you protect yourself against Agent Tesla using ITrust solutions?

To combat Agent Tesla, ITrust offers robust solutions tailored to today's threats:

  1. Ikare: A vulnerability scanner that identifies vulnerabilities before they are exploited, ensuring proactive protection.
  2. Reveelium: An AI-powered behavioral analytics platform capable of detecting abnormal behavior in real time, even when faced with unknown threats.
  3. SOC Service: 24/7 monitoring by experts to detect and block data exfiltration or malicious activity.
  4. Phishing Campaign: ITrust offers phishing campaigns to raise awareness and train your teams to detect cyber threats

Our products and services offer comprehensive, tailored protection against threats such as Agent Tesla.