IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Agent Tesla malware evades security controls to infect systems

The weakest link in malware prevention is still the average user

Security researchers have discovered new evasive techniques Agent Tesla information stealer and Remote Access Tool (RAT) operators are using.

According to a new report from Sophos, the malware’s more recent versions use many methods to make sandbox and static analysis more difficult and evade endpoint detection.

The report also found Agent Tesla’s RAT malware altered code in Microsoft’s Anti-Malware Software Interface (AMSI) so AMSI-enabled endpoint security protection doesn’t work, allowing the payload to download, install, and run without being blocked.

According to the report, the malware usually arrives in a malicious spam email as an attachment, such as a .zip compressed file attachment the attacker claims contain a catalog for the recipient to review.

Researchers said the downloader also tries to get the memory address of AmsiScanBuffer — calling Windows’ amsi.dll with the Windows LoadLibraryA function to get the DLL’s base address, and then GetProcAddress using that base address and the “AmsiScanBuffer” procedure name to get the address of the function.

According to the report, once Agent Tesla gets the AmsiScanBuffer address, it patches the first 8 bytes of this function in memory. The patch’s effect on the AmsiScanBuffer routine forces AMSI to return an error (code 0x80070057), making all the AMSI memory scans appear to be invalid.

Related Resource

Employees behaving badly?

Why awareness training matters

Why awareness training matters - whitepaper from MimecastDownload now

“This sabotages endpoint protection software dependent on AMSI, by essentially making them skip further AMSI scans for dynamically loaded assemblies within the Agent Tesla process,” researchers said.

They added that since this happens early in the first stage downloader’s execution, it renders ineffective any AMSI protection against the subsequent components of the downloader, the second-stage loader, and the Agent Tesla payload itself.

Sean Gallagher, senior security researcher at Sophos, said that Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users. 

“It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners. A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture,” he added.

Chris Hauk, consumer privacy champion at Pixel Privacy, told IT Pro that malware like Agent Tesla once again underscores that the weakest link in any line of malware defense is the average user. 

“Until users are educated and convinced not to open attachments or click links in emails and text messages, malware like Agent Tesla will continue to inflict itself on networks,” Hauk said.

Featured Resources

Join the 90% of enterprises accelerating to the cloud

Business transformation through digital modernisation

Free Download

Delivering on demand: Momentum builds toward flexible IT

A modern digital workplace strategy

Free download

Modernise the workforce experience

Actionable insights and an optimised experience for both IT and end users

Free Download

The digital workplace roadmap

A leader's guide to strategy and success

Free Download

Recommended

Protecting healthcare from cybercrime
Whitepaper

Protecting healthcare from cybercrime

25 May 2022
The truth about cyber security training
Whitepaper

The truth about cyber security training

25 Apr 2022
The truth about cyber security training
Whitepaper

The truth about cyber security training

25 Apr 2022
The Total Economic Impact™ of Mimecast
Whitepaper

The Total Economic Impact™ of Mimecast

25 Apr 2022

Most Popular

Raspberry Pi launches next-gen Pico W microcontroller with networking support
Hardware

Raspberry Pi launches next-gen Pico W microcontroller with networking support

1 Jul 2022
Universities are fighting a cyber security war on multiple fronts
cyber security

Universities are fighting a cyber security war on multiple fronts

4 Jul 2022
Hackers claim to steal personal data of over a billion people in China
data breaches

Hackers claim to steal personal data of over a billion people in China

4 Jul 2022