Malware

Agent Tesla

Also known as: AgenTesla · AgentTesla · Negasteal

A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.

Indicators of Compromise 2

Filename GoFlyDrv.sys Filename putty

MITRE ATT&CK TTPs 12

T1006
Direct Volume Access
Defense Evasion
 T1012
Query Registry
Discovery
 T1014
Rootkit
Defense Evasion
 T1053.005
Scheduled Task
Execution
 T1055
Process Injection
Defense Evasion
 T1055.015
ListPlanting
Defense Evasion
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1204.002
Malicious File
Execution
 T1548.002
Bypass User Account Control
Privilege Escalation

Source Articles

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
Cruciferra, a sophisticated crypter service linked to a China-based cybercrime group, is being used to deliver remote access trojans (RATs) and information stealers via phishing campaigns. It leverages advanced evasion techniques such as BYOVD, Process Ghosting, and API unhooking to avoid detection and hinder analysis. The threat targets multiple sectors including finance, healthcare, and government, primarily through tax-themed and social engineering lures. The malware establishes persistence via registry modifications and executes payloads in memory to minimize forensic traces.
hacker-news ·1d ago