Rewterz Threat Alert – Agent Tesla Old RAT Uses New Tricks to Stay on Top

Severity

Medium

Analysis Summary

Agent Tesla is, at its core, a keylogger and information stealer. First discovered in late 2014, there has been steady growth in the use of Agent Tesla over the last 1-2 years. The malware was initially sold in various underground forums and marketplaces, as well as it’s very own AgentTesla.com site (now defunct) Agent Tesla. The primary delivery mechanism for Agent Tesla is email (phishing messages). Attackers are often timely with their social engineering lures, and the current pandemic is not off limits to the attackers. In the last few months, attackers have been observed spreading Agent Tesla via COVID-themed messages, often masquerading as information information or updates from the WHO (World Health Organization).

Actors behind Agent Tesla campaigns have also used malicious Office documents to facilitate first-stage delivery. Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns. These and similar exploits allow for quick delivery and execution with minimal user interaction (beyond opening the malicious documents and allowing active content to proceed).

Over time, additional features have been added to Agent Tesla. These improvements include more robust spreading and injection methods as well as discovery and theft of wireless network details and credentials.

Impact

• Credential theft
• Information theft
• Exposure of sensitive data 

Indicators of Compromise

MD5

• a7772d0b18d4ab807881900ac626f7e7
• 4ef2d073c2bc1e3f2673155f0ecc6d25
• cf400f8fa702582e867d2f554c0fdf22
• 994a246ae96622526ff88956874f6ee1
• f5b4045d0f6ca45b5fe859bae8f370d0
• 55ce840c876175975994d7c1c744888c
• 59eecae993a95845f83b410d389aaa2e
• 10a83eef0c8a82d8c0d355d86cd3f9e0
• 054cad7b941f1153523212810fe3bb59
• dea9c53aa9e4e875fa8ab4cb5c8e723c
• 78576290fa4a53b428180616a02f0e03
• bb90ad32ac3b8eade0b34709025314a6
• 34d6bde00a9e785ed261af62f62b41f1

SHA-256

• 1abf66ab839c550bc77d97d1644c1225935a86b9591e9a95bcd606ebec6bbc19
• 7d1bcec8a3f71910e15cbb3adae945cd5096b7de259b51aef8f2e229bd4b40e2
• f24018dead69b0f899d33e73f72f5c3ef6f3c391850484b06b042f36dbc08cac
• 9b27388be292aea50d62cfebd130a9832f0d676feb28771d70d3e30bdb117f3a
• b74bcc77983d587207c127129cfda146644f6a4078e9306f47ab665a86f4ad13
• 7ec2b40879d6be8a8c6b6ba239d5ae547604ad2605de0d2501a4cca25915afa1
• f44c6c8c1c81f9990f11a0f70e6517c358fc1ee00a78b32461d4a2594b48e47d
• 648261052662b044dc233349ccdfa9dfd6853ec9a21ced386f8f172b2568b0d1
• aa08d96a25908ce76e07475aefbbe192bd812665a5600dc30600688510dd033e
• 0107fadc185fd6b53dc033d4a79e53ef1621ae623917de029b6c02eeae2021c1
• 7adc0e8236262080e62c4bfb97e745880247f9e244ae8718e60cc217a3ae773b
• 507b63c73ba3bee19c8c8afb40526c1196240376277f4b49e25bedc5d866b980
• 70aecc29ffb60caf068e4d8107f4d53fcdbd333bed7ac6fb3a852b00e86ded31
• a040efaf5dfac863805103ea0aa90a15b3690ad060188a15ea7d68491b274123
• 4007480b1a8859415bc011e4981f49ce2ff7a7dd7e883fe70d9f304cbfefedea
• 590c19542f6959d6424107eb4f2998b04d035575341b1f23a40dea6d82aecadd
• 7ce7bf11f6285621381b80027c488e9b5009205131a89738975ccc89574a1533
• be26ad023b732078c42b4f95067fb9107fe88aebd7ebbf852e7e968e50eee8a0
• 9fee57918672137160499dcd1a099670ef8f9a787f3a1ad6d8123df26cddbc3b
• 388386f3361138514c561dcf6169e8f9e8726c91e2dc66663efb07bf21ece052
• e2473526523180f460af4d8e164df9060c9f328cc7c0bae5846d51b28c12febe

SHA1

• 9e9c8ef7f20677795684b2749a59367cf5c3ec0a
• 4ffa900d7cf3ae6414bf90f6c9a4667cedfd57dd
• 83be2722b7adc91bc3ee219b75e9176bc7ce8e6e
• 3e15c7c82b875c3553456dc08a8b79019cb48644
• 3ce8f4bfeb99fa2fb8898c7664ad3838ce4a4fcf
• a2ad3ec4cd2d70edf2bc9089c493f898b7da44a5
• 72d3d907d7502c383ffc8239d255882838a5a6e4
• 683efb5746e85867b5d613dc07a116a80becce58
• 7e674dd61f0802316bc092ffd44f5b8a36ab26d5
• 3390272bb793ad15a45d647c3e5a716145fd262a
• 7cf661644a638dcb554a81ba490ddcaee2ed6f12
• 8f841e8f7d2c3334145c8c9f89c8cd6929a06b2a
• 6c2d55f7fcecdcae779b148f0060b8ab4062e0a9
• 05d74461b2a63b75f319ef2c5c4aa074af4e97c3
• 90fc8a737a7030db2e3583cbccb3156bb0a8ff12
• 160c5583f9ba3d11e94a0dd8c9a64936981e8194
• 5b744ce5d3cccd556d66704d8fdde882ea928829
• 7617dc78df626d5df43e38506fa7c577baef4bc5
• 8cd26c88b74f913f6e1c9d71a8d1e9aa53b7c6f6
• 859f498f0ba963e468a3912d936ad8e7ec01dbcd
• 94277994af62de5948d6de134edac0089a54b71e

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.