Dive into Agent Tesla

Estimated read time 4 min read

Today, we’re delving into the twisted world of one notorious culprit – Agent Tesla. It’s a name that’s been circling the dark web for a while now, raising alarms among cybersecurity professionals. Let’s pull back the curtain on this malware and shine some light on its dark motives.

What is Agent Tesla?

Agent Tesla is an information stealer, often classified as a Remote Access Trojan (RAT) or spyware. Released into the wild in 2014, it’s become a preferred tool among cybercriminals, notorious for its information-stealing and keylogging abilities.

Unpacking steps by Agent Tesla | Picture by Gatewatcher
Unpacking steps by Agent Tesla | Picture by Gatewatcher

Characteristics of Agent Tesla

This malware’s uniqueness lies in its multi-functionality. Agent Tesla can screen capture, keylog, and exfiltrate passwords. It can pilfer data from a range of apps, such as web browsers, email clients, and FTP software, making it a veritable Swiss army knife of cyber threats.

Furthermore, it regularly updates to stay ahead of anti-malware tools. Newer versions even boast sandbox evasion features, letting them fly under the radar of some of the most robust cybersecurity defenses.

Agent Tesla’s Exploitation of CVE-2017-11882 and CVE-2017-8570

Agent Tesla showcases its adaptability by exploiting some well-known vulnerabilities – namely, CVE-2017-11882 and CVE-2017-8570. Both of these vulnerabilities are found in Microsoft software, showing how even ubiquitous platforms aren’t immune to the machinations of crafty malware.

Exploiting CVE-2017-11882

CVE-2017-11882 is a vulnerability in Microsoft Office software that can allow an attacker to run arbitrary code in the context of the current user. With this security hole, a hacker can install programs, view, change, or delete data, or even create new accounts with full user rights.

Agent Tesla wields this vulnerability like a weapon. It’s often embedded in Office documents sent via phishing emails. Once the compromised document is opened, it takes advantage of the vulnerability to execute its malicious code and install the Agent Tesla malware.

Leveraging CVE-2017-8570

CVE-2017-8570 is another weakness in Microsoft’s armor that Agent Tesla exploits. This vulnerability lies within Office’s handling of encapsulated objects in documents. By exploiting this, Agent Tesla can again execute malicious code and find a foothold within the victim’s system.

Cybercriminals’ Utilization of Agent Tesla

It’s easy to see why the bad guys love Agent Tesla. Its multiple functionalities coupled with its low detection rate make it an effective tool for gaining unauthorized access and stealing sensitive data.

Cybercriminals often distribute Agent Tesla through phishing emails with malicious attachments. Once a user unsuspectingly opens one of these booby-trapped documents, the malware installs itself, paving the way for a series of cybercrimes.

Impact of Agent Tesla

The impact of Agent Tesla can be extensive. Confidential data? It’s theirs. Intellectual property? Also theirs. With the data they steal, cybercriminals can commit identity theft, fraudulent transactions, industrial espionage, and more.

Agent Tesla in the Cyber Kill Chain

Agent Tesla’s place in the cyber kill chain is primarily during the installation, command & control, and actions on objectives stages. During the installation stage, it finds its footing within a compromised system. Next, it connects back to its command & control server, ready to receive instructions. Finally, it performs its designated task: data theft.

Detecting and Defending Against Agent Tesla

Fret not, there are measures we can take to spot and stop this tricky customer. First up, hone your ability to spot phishing attempts – the main distribution method for Agent Tesla. Be suspicious of unsolicited emails, especially those with attachments or links.

Consider using advanced threat detection and response systems that can identify abnormal behavior, such as unexpected network communications or sudden changes in file systems.

Don’t skimp on updating and patching software – remember, Agent Tesla exploits software vulnerabilities. Regular patching can help you stay one step ahead.

And last but not least, consider implementing a solid Security Information and Event Management (SIEM) system. This can help in monitoring and analyzing anomalies in real-time, providing an essential layer of defense.

Agent Tesla Malware Analysis Report on Tria.ge
Agent Tesla Malware Analysis Report on Tria.ge

Agent Tesla hashes

Use these hashes to find reports of Agent Tesla malware samples:



  • Agent Tesla Malware Analysis by GateWatcher (PDF)
  • Agent Tesla Loader – Malware Analysis (PDF)
  • Malspam Sender Spoofing Indian Companies Drops Agent Tesla Keylogger (PDF)
  • CVE-2017-11882 (Visit Microsoft page)
  • CVE-2017-8570 (Visit Microsoft page)
  • Malgamy’s deep dive into Agent Tesla (Article)

Done reading? Join our Telegram channel.

Reza Rafati https://cyberwarzone.com

Reza Rafati, based in the Netherlands, is the founder of Cyberwarzone.com. An industry professional providing insightful commentary on infosec, cybercrime, cyberwar, and threat intelligence, Reza dedicates his work to bolster digital defenses and promote cyber awareness.

You May Also Like

More From Author