Agent Tesla Variant Steals Data and Uses Telegram for C2

Summary

Deep Instinct describes an Agent Tesla variant that steals keystrokes, clipboard contents, and credentials, uses Telegram for communications, and employs evasion techniques. The company says its product detected it before VirusTotal upload and most vendors.

Key points

• The Agent Tesla variant is described as stealing keystrokes, clipboard contents, browser credentials, and email passwords.
• The malware reportedly uses Telegram to communicate with its controllers and exfiltrate stolen data.
• Analysis cited in the article points to obfuscation, anti-analysis checks, and capabilities for file, registry, and system operations.
• Deep Instinct says its product detected and prevented the variant in customer environments a day before it was uploaded to VirusTotal.
• The article recommends monitoring legitimate messaging platforms for abuse and considering detection across the full attack lifecycle.
• The article says the variant may arrive through phishing, while its subsequent activity can operate silently.

Malware

Vendors

Products

Related Articles

• Report Details How Malware Crypting Services Help Threat Actors Evade DetectionAgent Tesla
• Obfuscated Lua and AutoIt Loaders Deploy RATs and Infostealers in Global Phishing CampaignAgent Tesla
• Fake Movie Torrent Delivers Agent Tesla Through Layered PowerShell ChainAgent Tesla
• TorNet Backdoor Uses Tor for Stealthy Command-and-Control in Phishing CampaignAgent Tesla
• Webinar Demonstrates Guardrail-Free LLM Creating Malware That Evaded 65 of 73 Legacy Security ToolsDSX Brain