Agent Tesla is a notorious .NET-based Remote Access Trojan (RAT) and information stealer that has been active since 2014. Marketed as a legitimate remote administration tool but widely abused by cybercriminals, it is sold as a malware-as-a-service (MaaS) with a dedicated builder interface that allows attackers to customize and deploy malicious payloads. The Agent Tesla Builder is the core component that enables even non-technical users to configure and generate these payloads, making it a significant threat in the cybercrime ecosystem.
Key Features of the Agent Tesla Builder
1. Customizable Payload Generation
The Agent Tesla Builder provides a simple interface for generating malicious payloads in various formats, enabling attackers to tailor attacks to specific targets:- Supported Formats: Payloads can be disguised as legitimate files, including .doc, .pdf, .png, .mp4, .lnk, .hta, .exe, and .zip files.
- Obfuscation Techniques: The builder uses Base64 encoding, XOR encryption, and packers like KoiVM to obfuscate payloads, making them harder to detect by antivirus software.
- Polymorphic Payloads: Generates unique payloads to bypass signature-based detection, often executing in memory to avoid disk-based traces.
- Integration with Builders like Quantum Builder: Recent campaigns leverage tools like Quantum Builder to create malicious LNK, HTA, and PowerShell payloads, enhancing delivery mechanisms.
2. Data Theft Capabilities
The builder allows attackers to configure Agent Tesla to steal a wide range of sensitive information:- Keylogging: Records keystrokes to capture passwords, usernames, and other typed data across applications.
- Credential Harvesting: Extracts credentials from over 55 applications, including web browsers (e.g., Google Chrome, Mozilla Firefox), email clients (e.g., Outlook, Thunderbird), VPNs, and FTP clients.
- Clipboard Monitoring: Captures clipboard content, such as copied passwords or sensitive text.
- Browser Data Extraction: Retrieves cookies, browsing history, auto-complete data, and saved credentials from multiple browsers.
- Wi-Fi Credential Theft: Newer variants target Wi-Fi profiles and passwords to spread infections across networks.
- Email Data Theft: Collects email credentials, message content, contact lists, and attachments from email clients.
Last edited:
