Agent Tesla Malware Analysis: Inside the .NET RAT’s Data Theft Capabilities

Summary

Agent Tesla is a .NET-based remote access trojan offered through a malware-as-a-service model and aimed at Windows systems. It is designed to steal credentials, browser-stored information, and user communications through capabilities such as keylogging and screenshot capture. The malware supports several exfiltration channels, including SMTP, FTP, and HTTP traffic routed through the Tor network.

Investigation

The article explains how Agent Tesla operates from initial spear-phishing delivery through persistence and eventual data theft. It highlights use of the SetWindowsHookEx API for keylogging and describes the malware’s focus on browser data and email client storage locations. The analysis also shows how the malware uses the Tor browser to help conceal exfiltration traffic.

Mitigation

Organizations should deploy strong email security controls to block malicious attachments such as .chm files and macro-enabled documents. Monitoring for unauthorized registry changes in Run keys and Winlogon\Shell values is also important. In addition, blocking known exfiltration methods and watching for unusual Tor-related network activity can help reduce the impact of compromise.

Response

If Agent Tesla is detected, isolate the affected Windows host immediately to stop further exfiltration. Perform forensic analysis to identify the original infection source, such as a phishing email or weaponized attachment. Review registry locations and startup folders for persistence mechanisms, and remove temporary files or artifacts associated with the malware.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access and seeks to establish persistence to maintain access to the victim’s machine. To simulate Agent Tesla, the attacker performs two distinct actions:

  1. They modify the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key to execute a malicious payload every time the user logs in.
  2. They attempt a more aggressive technique by modifying the WinlogonShell registry value, replacing the standard explorer.exe with a malicious executable to hijack the entire user shell environment. These actions are chosen to test the detection’s ability to catch both standard and high-impact registry persistence.

• Regression Test Script:

  # Simulation script for Agent Tesla Persistence TTPs
  
  $maliciousPath = "C:WindowsTempagent_tesla_sim.exe"
  Write-Host "[*] Creating dummy payload at $maliciousPath"
  New-Item -Path $maliciousPath -ItemType File -Force
  
  Write-Host "[*] Simulating T1547.001: Modifying Run Key"
  $runKey = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  New-ItemProperty -Path $runKey -Name "AgentTeslaPersistence" -Value $maliciousPath -PropertyType String -Force
  
  Write-Host "[*] Simulating T1547.014: Modifying Winlogon Shell"
  $winlogonKey = "HKCU:SoftwareMicrosoftWindows NTCurrentVersionWinlogon"
  New-ItemProperty -Path $winlogonKey -Name "Shell" -Value "explorer.exe, $maliciousPath" -PropertyType String -Force
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # Cleanup script to remove persistence and dummy files
  Write-Host "[*] Cleaning up registry keys..."
  Remove-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" -Name "AgentTeslaPersistence" -ErrorAction SilentlyContinue
  Remove-ItemProperty -Path "HKCU:SoftwareMicrosoftWindows NTCurrentVersionWinlogon" -Name "Shell" -ErrorAction SilentlyContinue
  
  Write-Host "[*] Deleting dummy payload..."
  Remove-Item -Path "C:WindowsTempagent_tesla_sim.exe" -Force -ErrorAction SilentlyContinue
  
  Write-Host "[+] Cleanup complete."