Agent Tesla malware evades security controls to infect systems

Security researchers have uncovered new evasive procedures Agent Tesla details stealer and Distant Obtain Tool (RAT) operators are using.

According to a new report from Sophos, the malware’s a lot more current variations use several approaches to make sandbox and static examination more difficult and evade endpoint detection.

The report also observed Agent Tesla’s RAT malware altered code in Microsoft’s Anti-Malware Software Interface (AMSI) so AMSI-enabled endpoint security security doesn’t function, making it possible for the payload to down load, put in, and run with out becoming blocked.

According to the report, the malware typically comes in a destructive spam email as an attachment, this kind of as a .zip compressed file attachment the attacker claims incorporate a catalog for the receiver to evaluation.

Researchers said the downloader also tries to get the memory tackle of AmsiScanBuffer — contacting Windows’ amsi.dll with the Windows LoadLibraryA operate to get the DLL’s foundation deal with, and then GetProcAddress using that foundation handle and the “AmsiScanBuffer” treatment title to get the deal with of the operate.

In accordance to the report, once Agent Tesla gets the AmsiScanBuffer handle, it patches the first 8 bytes of this functionality in memory. The patch’s result on the AmsiScanBuffer schedule forces AMSI to return an error (code 0x80070057), building all the AMSI memory scans seem to be invalid.

“This sabotages endpoint safety application dependent on AMSI, by in essence creating them skip more AMSI scans for dynamically loaded assemblies in just the Agent Tesla procedure,” scientists mentioned.

They added that given that this happens early in the initial phase downloader’s execution, it renders ineffective any AMSI defense against the subsequent factors of the downloader, the 2nd-phase loader, and the Agent Tesla payload alone.

Sean Gallagher, senior security researcher at Sophos, said that Agent Tesla malware has been lively for additional than seven several years, still it continues to be just one of the most popular threats to Windows customers. 

“It has been among the the top rated malware households dispersed via email in 2020. In December, Agent Tesla payloads accounted for all around 20% of malicious email attachment attacks intercepted by Sophos scanners. A wide variety of attackers use the malware to steal user qualifications and other information and facts from targets through screenshots, keyboard logging and clipboard seize,” he included.

Chris Hauk, customer privacy champion at Pixel Privacy, explained to IT Pro that malware like Agent Tesla once all over again underscores that the weakest website link in any line of malware protection is the average consumer. 

“Until people are educated and confident not to open attachments or click on inbound links in e-mail and textual content messages, malware like Agent Tesla will continue on to inflict by itself on networks,” Hauk mentioned.

Some sections of this report are sourced from:
www.itpro.co.uk