Agenttesla

Malware updated 4 months ago (2024-06-03T17:17:39.824Z)
Download STIX
Preview STIX
AgentTesla is a well-known remote access trojan (RAT) that has been used extensively in cybercrime operations. It infiltrates systems through various methods, including malicious emails and suspicious downloads. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. Recently, the malware has been observed being delivered via a dropper executable variant and another separate TicTacToe dropper sample. The final payload in these samples was detected as AgentTesla, indicating its continued prevalence in the threat landscape. DBatLoader, also known as ModiLoader, a malware strain observed since 2020, has been used to download and execute the final payload of commodity malware campaigns, such as AgentTesla. DBatLoader campaigns are often initiated through malicious emails and are known to abuse cloud services to stage and retrieve additional payloads. Furthermore, AgentTesla has been found in the arsenal of several cybercrime groups along with other malware like FormBook, Remcos, LokiBot, GuLoader, Snake Keylogger, and XWorm. Despite changes in the malware-as-a-service (MaaS) market, AgentTesla remains a dominant player due to its effective and stealthy operation. In one documented infection chain, victims downloaded an Excel document exploiting a vulnerability in outdated versions of Microsoft Office, leading to the injection of AgentTesla. In older versions of Acrobat Reader, the automatic execution of malicious JavaScript could also lead to the injection of AgentTesla via PowerShell into Regsvcs.exe. This malware leverages Telegram bots for data exfiltration, taking advantage of their security, anonymity, ease of use, stealth, and resilience. This combination makes Telegram bots an appealing choice for AgentTesla's data exfiltration tactics.
Description last updated: 2024-06-03T16:17:57.719Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Dcrat is a possible alias for Agenttesla. DcRAT is a malicious software (malware) known as a Remote Access Trojan (RAT), which has been utilized in a widespread campaign to exploit computer systems. The malware infiltrates systems through deceptive methods, including downloads from fake Google Meet and OnlyFans sites. When a user interacts
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Payload
Spam
Loader
Discord
Windows
Rat
Telegram
Phishing
Downloader
Trojan
Remcos
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Lokibot Malware is associated with Agenttesla. LokiBot is a malicious software, or malware, that was first reported on October 24, 2020. It is designed to exploit and damage computer systems by infiltrating them through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, LokiBot steals personal informationUnspecified
6
The njRAT Malware is associated with Agenttesla. NjRAT is a remote-access Trojan (RAT) that has been in use since 2013, often deployed in both criminal and targeted attacks. This malware can infiltrate systems via suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside a system, NjRAT can steal personal information, dUnspecified
5
The Redline Malware is associated with Agenttesla. RedLine is a type of malware, a malicious software designed to exploit and damage computer systems. It can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, RedLine can steal personal information, disrupt operations, or deliver further Unspecified
5
The Xworm Malware is associated with Agenttesla. XWorm is a multifaceted malware that has been used by threat actors to exploit vulnerabilities in systems running the ScreenConnect client software. The malicious software, first reported in 2023, provides remote access capabilities, has the potential to spread across networks, and can exfiltrate seUnspecified
4
The Formbook Malware is associated with Agenttesla. Formbook is a type of malware, malicious software designed to exploit and damage computer systems. It infects systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. Formbook has been linked with other forms oUnspecified
3
The NanoCore Malware is associated with Agenttesla. NanoCore is a notorious Remote Access Trojan (RAT) first discovered in 2013. It targets Windows operating system users and operates by opening a backdoor on an infected computer to steal information. NanoCore has maintained a top five position for six consecutive months, taking the third spot in DecUnspecified
2
The Raccoon Malware is associated with Agenttesla. Raccoon, also known as Racealer, is a potent malware-as-a-service (MaaS) info stealer that was first detected in 2019. Utilized by Scattered Spider threat actors, this malware is used to obtain sensitive information such as login credentials, browser cookies, and browsing histories from victims' sysUnspecified
2
The NETWIRE Malware is associated with Agenttesla. NetWire is a type of malware, specifically a remote access trojan (RAT), that has been utilized for various malicious activities since at least 2014. Initially promoted as a legitimate tool for managing Windows computers remotely, NetWire was quickly adopted by cybercriminals and used in phishing atUnspecified
2
The DarkComet Malware is associated with Agenttesla. DarkComet is a Remote Access Trojan (RAT) that opens a backdoor on infected computers, allowing unauthorized access and data theft. This malware has been classified among the top five Command and Control (C2) families, indicating its widespread usage by cybercriminals. DarkComet, along with other esUnspecified
2
The AsyncRAT Malware is associated with Agenttesla. AsyncRAT is a type of malware, malicious software designed to exploit and damage computer systems. It infects systems through dubious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. This freely available infostealer can record vUnspecified
2
Source Document References
Information about the Agenttesla Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
Checkpoint
4 months ago
SANS ISC
6 months ago
BankInfoSecurity
6 months ago
CERT-EU
7 months ago
CERT-EU
7 months ago
CERT-EU
7 months ago
CERT-EU
7 months ago
CERT-EU
7 months ago
InfoSecurity-magazine
8 months ago
Fortinet
8 months ago
CERT-EU
9 months ago
Secureworks
2 years ago
CERT-EU
2 years ago
CERT-EU
10 months ago
MITRE
10 months ago
CERT-EU
a year ago
CERT-EU
a year ago
Checkpoint
a year ago
CERT-EU
a year ago
CERT-EU
a year ago