- Malware analysis
- March 2023
AgentTesla: a capabilities review and detection strategies
A breakdown of the AgentTesla infostealer's capabilities, its delivery through phishing attachments, and the detection logic that catches it.
Attribution
Published by the Logpoint security research team, which I led. Bylined Anish Bogati.
I led the research function that produced this work. The byline is the team’s, not mine.
Part of Logpoint's Emerging Threats series. Each entry shipped as a blog post plus a downloadable report carrying the analysis, detection rules and mitigation guidance.
The review covers AgentTesla's capabilities as an infostealer, its arrival through phishing attachments, the obfuscation it uses to survive inspection, and prevalence figures drawn from MalwareBazaar. It maps behaviour to ATT&CK (T1566.001 for the spearphishing attachment, T1027.002 for software packing) and links the tooling to activity tracked as SILVERTERRIER, SWEED and Aggah.
My role was leading the research function that produced this, not writing it. The byline is Anish Bogati's.
Identifiers
The machine-readable references this entry covers.
- T1566.001ATT&CK technique
- T1027.002ATT&CK technique
The original
The canonical version is published at guardsix.com. This page is a framing note, not a copy of it.
Open the original