Currently viewing ATT&CK v8.2 which was live between October 27, 2020 and April 28, 2021. Learn more about the versioning system or see the live site.
SOFTWARE
Aria-body
SOFTWARE
1-9
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Y-Z
  1. Home
  2. Software
  3. Agent Tesla

Agent Tesla

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]

ID: S0331
Type: MALWARE
Platforms: Windows
Version: 1.1
Created: 29 January 2019
Last Modified: 28 May 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1087 .001 Account Discovery: Local Account

Agent Tesla can collect account information from the victim’s machine.[4]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Agent Tesla has used HTTP for C2 communications.[4][5]
.003 Application Layer Protocol: Mail Protocols

Agent Tesla has used SMTP for C2 communications.[4][5][2]
Enterprise T1560 Archive Collected Data

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.[6]
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Agent Tesla can add itself to the Registry as a startup program to establish persistence.[1]
Enterprise T1115 Clipboard Data

Agent Tesla can steal data from the victim’s clipboard.[6][1][5][2]
Enterprise T1555 Credentials from Password Stores

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.[3]
Enterprise T1140 Deobfuscate/Decode Files or Information

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.[3]
Enterprise T1048 .003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.[6][2]
Enterprise T1564 .003 Hide Artifacts: Hidden Window

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.[3]
Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Agent Tesla has the capability to kill any running analysis processes and AV software.[5]
Enterprise T1105 Ingress Tool Transfer

Agent Tesla can download additional files for execution on the victim’s machine.[6][4]
Enterprise T1056 .001 Input Capture: Keylogging

Agent Tesla can log keystrokes on the victim’s machine.[6][4][5][2]
Enterprise T1185 Man in the Browser

Agent Tesla has the ability to use form-grabbing to extract data from web data forms.[2]
Enterprise T1027 Obfuscated Files or Information

Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.[1] Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.[3]
Enterprise T1057 Process Discovery

Agent Tesla can list the current running processes on the system.[5]
Enterprise T1113 Screen Capture

Agent Tesla can capture screenshots of the victim’s desktop.[6][4][1][5][2]
Enterprise T1082 System Information Discovery

Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.[1][5][3]
Enterprise T1016 System Network Configuration Discovery

Agent Tesla can collect the IP address of the victim machine.[4]
Enterprise T1033 System Owner/User Discovery

Agent Tesla can collect the username from the victim’s machine.[4][1][3]
Enterprise T1124 System Time Discovery

Agent Tesla can collect the timestamp from the victim’s machine.[4]
Enterprise T1204 .002 User Execution: Malicious File

Agent Tesla has been executed through malicious e-mail attachments [2]
Enterprise T1125 Video Capture

Agent Tesla can access the victim’s webcam and record video.[4][6]
Enterprise T1497 Virtualization/Sandbox Evasion

Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.[3]

Groups That Use This Software

ID Name References
G0083 SilverTerrier

[7]

References

  1. Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.
  2. Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.
  3. Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.
  4. The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.
  1. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  2. Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018.
  3. Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018.