Unfolding Agent Tesla: The Art of Credentials Harvesting. Dropper Analysis

3 min readFeb 6, 2024

Analysis of Agent Tesla, A Close Look at Password Theft Technique

— Part — 1 — Dropper Analysis

Executive Summary

Agent Tesla is a very detailed form of malware that typically infiltrates systems through deceptive emails. Once executed, it goes through multiple stages, using various droppers to disguise its presence. The malware’s primary goal is to steal sensitive information, such as passwords, from web browsers, email, VPN, and FTP clients. It then secretly transmits this stolen data to the attacker’s email through a compromised email server.

This highlights the importance of being cautious with email attachments to prevent falling victim to such malicious activities.

Malware Flow

Agent Tesla starts its malicious journey through a phishing email. The initial carrier is an {EXE} file, known as the dropper. Inside this executable file, there is a second stage {DLL} that gets loaded into its modules. Subsequently, a third stage {DLL} is loaded, followed by a fourth stage {DLL}. This fourth {DLL} is crucial, as it contains the actual Agent Tesla binary, which is also an {EXE} file.

Upon execution, this fourth-stage binary extracts the Agent Tesla payload, decrypts it, and injects the Agent Tesla binary into its own running process. In simpler terms, it activates the malicious code within itself. The final stage binary is responsible for harvesting credentials from various sources, including browsers, email clients, VPN clients, and FTP clients.

Once it successfully collects passwords from the system, the malware takes the next step by sending this stolen data to the attacker’s email address. To achieve this, it utilizes a compromised email server, completing the malicious cycle initiated by the phishing email.