This malware abuses Tor and Telegram infrastructure to evade detection

Skull and Bones
(Image credit: Pixabay)
Audio player loading…

For more than seven years, the Agent Tesla (opens in new tab) family of remote access trojan (RAT) malware (opens in new tab) has remained one of the most common threats to Windows users online as it is continually updated by its creators.

A variety of cybercriminals leverage the malware to steal user credentials and other information through screenshots, keylogging and clipboard capture. However, as Agent Tesla's compiler hard-codes operator-specific variables when its built, the malware's behavior can vary widely as it continues to evolve.

According to Sophos (opens in new tab), recent changes to the malware increased the number of applications targeted for credential theft to include web browsers, email clients, VPN (opens in new tab) clients and other software that stores usernames and passwords.

SophosLabs has tracked multiple threat actors using Agent Tesla and as of December of last year, it accounted for 20 percent of malicious email attachments detected in the company's customer telemetry.

Agent Tesla v3

In its new report (opens in new tab) on Agent Tesla, Sophos sheds further light on two currently active versions of the malware identified as version 2 and version 3 to show how the RAT (opens in new tab) has evolved by using multiple types of defense evasion and obfuscation to avoid detection.

While both versions of the malware can be configured to communicate over HTTP, SMTP and FTP, version 3 adds the Telegram (opens in new tab) chat protocol as an option so that attackers can exfiltrate stolen data to a private Telegram chat room.

At the same time, Agent Tesla v3 also allows an attacker to decide whether or not they wish to deploy a Tor (opens in new tab) client to conceal their communications and this version of the malware can even steal the contents of the Windows system clipboard.

As malicious spam is the most common delivery method for Agent Tesla, Sophos recommends that organizations and individuals treat email attachments from unknown senders (opens in new tab) with caution and verify the integrity of attachments before opening them.

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.