Procedure examples

Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.

Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.

Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.

Agent Tesla can collect the username from the victim’s machine.

Agent Tesla has used wmi queries to gather information from the system.

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

Agent Tesla has achieved persistence via scheduled tasks.

Agent Tesla can inject into known, vulnerable binaries on targeted hosts.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.

Agent Tesla can log keystrokes on the victim’s machine.

Agent Tesla can list the current running processes on the system.

Agent Tesla has used HTTP for C2 communications.

Agent Tesla has used SMTP for C2 communications.

Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.

Agent Tesla can collect account information from the victim’s machine.

Agent Tesla can download additional files for execution on the victim’s machine.

Agent Tesla can achieve persistence by modifying Registry key entries.

Agent Tesla can capture screenshots of the victim’s desktop.

Agent Tesla can steal data from the victim’s clipboard.

Agent Tesla can collect the timestamp from the victim’s machine.

Agent Tesla can access the victim’s webcam and record video.

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.

Agent Tesla has the ability to use form-grabbing to extract data from web data forms.

Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.

Agent Tesla has been executed through malicious e-mail attachments

Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.

Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.

Agent Tesla can add itself to the Registry as a startup program to establish persistence.

Agent Tesla has the ability to extract credentials from configuration or support files.

Agent Tesla has the ability to extract credentials from the Registry.

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.

Agent Tesla can gather credentials from a number of browsers.

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.

Agent Tesla has created hidden folders.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.

The primary delivered mechanism for Agent Tesla is through email phishing messages.

Agent Tesla has the capability to kill any running analysis processes and AV software.