RAT / stealerATT&CK S0331
Agent Tesla
Agent Tesla is a .NET remote access trojan and information stealer sold to criminals as a service. It records keystrokes, captures the screen and clipboard, and steals saved credentials from browsers and email clients. CISA listed it among the top malware strains of 2021.
- Public attribution and associated actors
- Sold to many criminals as a service; MITRE ATT&CK lists SilverTerrier and TA2541 among its users.As publicly reported:SilverTerrierTA2541
- First seen
- Around 2014
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0331 Agent Tesla
How it spreads or gets in
- Phishing emails with malicious attachments, often themed as invoices or shipping notices.
Key behaviours
- Logged keystrokes and captured screenshots and clipboard data.
- Stole saved credentials from browsers, email and FTP clients.
- Sent stolen data out over email (SMTP), FTP or HTTP.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1204.002User Execution: Malicious File
- T1056.001Input Capture: Keylogging
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
- T1113Screen Capture
- T1115Clipboard Data
- T1071.003Application Layer Protocol: Mail Protocols
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on workstations sending SMTP traffic directly to the internet.
- Detect processes reading browser credential stores that are not the browser.
- Flag new Run-key persistence created by recently downloaded files.
Defences that work
- Block outbound SMTP except from mail servers.
- Filter attachments and train staff on invoice and shipping lures.
- Use a password manager and MFA so stolen browser passwords are less useful.