Origins of a logger - Agent Tesla

## Overview

Agent Tesla is a remote access trojan (RAT) and .NET binary targeting Windows systems since 2014. Originally released as free software with capabilities including password stealing, key logging, and screenshot capture, it became one of the earliest and most successful malware-as-a-service (MaaS) offerings. The presentation traces Agent Tesla's evolution from a free tool shared on underground forums to a paid service sold via agent-tesla.com starting in 2014, its rebranding as "Origin Logger" after law enforcement action closed official sales channels in 2019, and technical analysis of the protectors and infrastructure used by its developers.

## Key Topics

**Malware-as-a-Service Pioneer:** Agent Tesla fundamentally changed the underground market by demonstrating that malware could be packaged and sold like legitimate software, enabling less sophisticated threat actors to launch campaigns without developing their own tools. The developers realized this business model was viable after initially sharing free versions and shifted to paid sales in 2014, establishing agent-tesla.com as their primary sales platform.

**Origin Logger as Agent Tesla v3:** Despite some public reporting treating Origin Logger as a separate malware family, it is definitively a variant of Agent Tesla version 3. The developers retained the original source code while adding new features including Tor connectivity and Telegram-based C2 communication. Origin Logger infrastructure launched on domains including origin-pro.me and origin-pro.nl in 2018. After Agent Tesla sales domains were closed in 2019 due to legal pressure, the team announced Origin Logger on Discord servers as their successor product.

**Campaign Attribution:** Business Email Compromise attacks using Origin Logger primarily target Turkey, Germany, Poland, and England. The threat actors tailor malware filenames to match victim geographies (e.g., Turkish names for Turkish targets) and distribute archives via Mediafire. The threat actors announced retirement in July 2024 after 10 years of operations, yet C2 infrastructure remained active.

## Technical Details

**Cassandra Protector:** Origin Logger samples employ Cassandra Protector, a .NET-specific packer developed and advertised on underground forums starting October 2018. The protector offers customizable injection methods, anti-virus evasion tactics, anti-emulation features, and execution delays. Protected files use RC4-encrypted resources and dynamically load modules at runtime via assembly load events.

**Infection Chain:** Phishing emails direct victims to Mediafire links hosting .tar.gz archives containing bloated executables (~800MB padded with null bytes to evade signature-based detection). The packed executable loads multiple modules sequentially; the final module named "Tyron" decrypts protected resources, establishes persistence through scheduled tasks, and exfiltrates credentials to a Telegram C2 panel. The original malware payload is only ~1MB but expands to 700MB+ when padded.

**Chiron Unpacker:** Malwan developed Chiron to automate unpacking of Cassandra-protected samples. It creates a special application domain, hooks assembly load events to intercept dynamically loaded .NET modules, defeats Confuser X string encryption and control flow obfuscation protections, and extracts configuration data including C2 panel addresses and authentication credentials.

## Takeaways

1. Origin Logger represents a continuation of Agent Tesla under a new brand, emphasizing that behavioral and infrastructural analysis is critical for accurate attribution of rebranded malware. 2. The malware-as-a-service model pioneered by Agent Tesla in 2014 has become foundational to modern cybercriminal ecosystems, lowering barriers to entry for threat actors. 3. Automated unpacking tools are essential for scaling malware analysis and extracting actionable intelligence from protected samples. 4. Despite threat actor claims of retirement in 2024, active C2 infrastructure suggests ongoing operations or inadequate operational cleanup. 5. Proactive threat intelligence targeting threat actor identification and infrastructure takedown is more valuable than reactive publication of indicators of compromise.