SentinelLabs Agent Tesla Aug 2020

Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

Agent Tesla has achieved persistence via scheduled tasks.

Agent Tesla can inject into known, vulnerable binaries on targeted hosts.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.

Agent Tesla can log keystrokes on the victim’s machine.

Agent Tesla can achieve persistence by modifying Registry key entries.

Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.

Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.

Agent Tesla can add itself to the Registry as a startup program to establish persistence.

Agent Tesla has the ability to extract credentials from configuration or support files.

Agent Tesla has the ability to extract credentials from the Registry.

Agent Tesla has created hidden folders.