IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Agent Tesla malware evades security controls to infect systems

The weakest link in malware prevention is still the average user

Security researchers have discovered new evasive techniques Agent Tesla information stealer and Remote Access Tool (RAT) operators are using.

According to a new report from Sophos, the malware’s more recent versions use many methods to make sandbox and static analysis more difficult and evade endpoint detection.

The report also found Agent Tesla’s RAT malware altered code in Microsoft’s Anti-Malware Software Interface (AMSI) so AMSI-enabled endpoint security protection doesn’t work, allowing the payload to download, install, and run without being blocked.

According to the report, the malware usually arrives in a malicious spam email as an attachment, such as a .zip compressed file attachment the attacker claims contain a catalog for the recipient to review.

Researchers said the downloader also tries to get the memory address of AmsiScanBuffer — calling Windows’ amsi.dll with the Windows LoadLibraryA function to get the DLL’s base address, and then GetProcAddress using that base address and the “AmsiScanBuffer” procedure name to get the address of the function.

According to the report, once Agent Tesla gets the AmsiScanBuffer address, it patches the first 8 bytes of this function in memory. The patch’s effect on the AmsiScanBuffer routine forces AMSI to return an error (code 0x80070057), making all the AMSI memory scans appear to be invalid.

Related Resource

Employees behaving badly?

Why awareness training matters

Why awareness training matters - whitepaper from MimecastDownload now

“This sabotages endpoint protection software dependent on AMSI, by essentially making them skip further AMSI scans for dynamically loaded assemblies within the Agent Tesla process,” researchers said.

They added that since this happens early in the first stage downloader’s execution, it renders ineffective any AMSI protection against the subsequent components of the downloader, the second-stage loader, and the Agent Tesla payload itself.

Sean Gallagher, senior security researcher at Sophos, said that Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users. 

“It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners. A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture,” he added.

Chris Hauk, consumer privacy champion at Pixel Privacy, told IT Pro that malware like Agent Tesla once again underscores that the weakest link in any line of malware defense is the average user. 

“Until users are educated and convinced not to open attachments or click links in emails and text messages, malware like Agent Tesla will continue to inflict itself on networks,” Hauk said.

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

What is zero trust?
network security

What is zero trust?

14 Jul 2022
An analysis of the European cyber threat landscape
Whitepaper

An analysis of the European cyber threat landscape

8 Jul 2022
Protecting healthcare from cybercrime
Whitepaper

Protecting healthcare from cybercrime

25 May 2022
The truth about cyber security training
Whitepaper

The truth about cyber security training

25 Apr 2022

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
UK water supplier confirms hack by Cl0p ransomware gang
ransomware

UK water supplier confirms hack by Cl0p ransomware gang

16 Aug 2022