Agenttesla

AgentTesla is a well-known remote access trojan (RAT) that has been used extensively in cybercrime operations. It infiltrates systems through various methods, including malicious emails and suspicious downloads. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. Recently, the malware has been observed being delivered via a dropper executable variant and another separate TicTacToe dropper sample. The final payload in these samples was detected as AgentTesla, indicating its continued prevalence in the threat landscape. DBatLoader, also known as ModiLoader, a malware strain observed since 2020, has been used to download and execute the final payload of commodity malware campaigns, such as AgentTesla. DBatLoader campaigns are often initiated through malicious emails and are known to abuse cloud services to stage and retrieve additional payloads. Furthermore, AgentTesla has been found in the arsenal of several cybercrime groups along with other malware like FormBook, Remcos, LokiBot, GuLoader, Snake Keylogger, and XWorm. Despite changes in the malware-as-a-service (MaaS) market, AgentTesla remains a dominant player due to its effective and stealthy operation. In one documented infection chain, victims downloaded an Excel document exploiting a vulnerability in outdated versions of Microsoft Office, leading to the injection of AgentTesla. In older versions of Acrobat Reader, the automatic execution of malicious JavaScript could also lead to the injection of AgentTesla via PowerShell into Regsvcs.exe. This malware leverages Telegram bots for data exfiltration, taking advantage of their security, anonymity, ease of use, stealth, and resilience. This combination makes Telegram bots an appealing choice for AgentTesla's data exfiltration tactics.