Agent Tesla

Malware & Tools · Agent Tesla

· MalwareS0331 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.(Citation: Fortinet Agent Tesla April 2018)(Citation: Bitdefender Agent Tesla April 2020)(Citation: Malwarebytes Agent Tesla April 2020)

Tactic Coverage

discovery (8)stealth (8)collection (6)credential access (5)execution (4)privilege escalation (4)persistence (3)command and control (3)defense impairment (2)exfiltration (1)initial access (1)

Used By (2 groups)

G0083SilverTerrier G1018TA2541

Techniques (37)

T1016System Network Configuration Discovery

discovery

T1016.002Wi-Fi Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1033System Owner/User Discovery

discovery

T1047Windows Management Instrumentation

execution

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

exfiltration

T1053.005

References

https://attack.mitre.org/software/S0331 https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/https://www.digitrustgroup.com/agent-tesla-keylogger/https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html

executionpersistence

T1055Process Injection

stealthprivilege escalation

T1055.012Process Hollowing

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1071.001Web Protocols

command and control

T1071.003Mail Protocols

command and control

T1082System Information Discovery

discovery

T1087.001Local Account

discovery

T1105Ingress Tool Transfer

command and control

T1112Modify Registry

defense impairmentpersistence

T1113Screen Capture

collection

T1115Clipboard Data

collection

T1124System Time Discovery

discovery

T1125Video Capture

collection

T1140Deobfuscate/Decode Files or Information

stealth

T1185Browser Session Hijacking

collection

T1203Exploitation for Client Execution

execution

T1204.002Malicious File

execution

T1218.009Regsvcs/Regasm

stealth

T1497Virtualization/Sandbox Evasion

stealthdiscovery

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1552.001Credentials In Files

credential access

T1552.002Credentials in Registry

credential access

T1555Credentials from Password Stores

credential access

T1555.003Credentials from Web Browsers

credential access

T1560Archive Collected Data

collection

T1564.001Hidden Files and Directories

stealth

T1564.003Hidden Window

stealth

T1566.001Spearphishing Attachment

initial access

T1685Disable or Modify Tools

defense impairment