(Fortinet) FortiGuard Labs recently captured some malware which was developed using the Microsoft .Net framework. I analyzed one of them, it's a new variant from AgentTasla family. In this blog, I’m going to show you how it is able to steal information from a victim’s machine. The malware was spread via a Microsoft Word document that contained an auto-executable malicious VBA Macro.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|---|
| 51.222.104.17:21 | 2023-11-24 |
| 185.80.2.120:21 | 2023-11-22 |
| 162.144.23.32:21 | 2023-11-22 |
| 192.185.152.133:21 | 2023-11-22 |
| 188.241.222.22:21 | 2023-11-22 |
| 43.230.131.138:57745 | 2023-11-12 |
| 43.230.131.138:21 | 2023-11-12 |
| 91.92.255.16:80 | 2023-12-01 |
| 31.220.2.200:80 | 2023-12-01 |
| 141.98.6.154:80 | 2023-11-08 |
| Domain | Timestamp |
|---|---|
| ftp.atelierzolotas.gr | 2023-11-29 |
| ftp.siscop.com.co | 2023-11-24 |
| mail.amtechcards.com | 2023-10-19 |
| kenesrakishev.net | 2023-10-12 |
| poituox.fr | 2023-11-02 |
| rakishev.net | 2023-10-03 |
| suchitanandanmahavidyalaya.org | 2023-10-14 |
| www.upadte-reviewer-online.live | 2023-09-23 |
| upadte-reviewer-online.live | 2023-09-04 |
| macarty.ydns.eu | 2023-08-29 |
| URL | Timestamp |
|---|---|
| https://www.rakishevkenes.com/WebPanel/login.php | 2023-11-14 |
| http://91.92.255.16/mana/inc/61b46e405d2c1c.php | 2023-11-06 |
| http://31.220.2.200/~gollpree/4/inc/80c2d1651b23ae.php | 2023-11-02 |
| https://atelierzolotas.com/work/83461806.IMG | 2023-10-30 |
| https://discordapp.com/api/webhooks/1166302871613087784/nCg-9BRiGEVs0MiVwMTqq2QpA1zjZAVmt6WwJeafNmLmk88WIG2BMzUo6OyGTXikDTY9 | 2023-10-24 |
| https://api.telegram.org/bot6357654685:AAFiKfbD5-YBSFCVzqybSStRmGTBTAvfm00/ | 2023-10-24 |
| https://api.telegram.org/bot6965219356:AAHyrA1bIgaLJof2YxCIzYRgbH23pVjvG0U/ | 2023-10-24 |
| http://cloudhost.myfirewall.org:2180/xlsx/inc/04a95340139b93.php | 2023-10-23 |
| http://89.47.1.10/autdolorem.php | 2023-10-15 |
| http://89.47.1.10/news.php | 2023-10-15 |
2023-10-12 by Cluster25 Threat Intel Team from Cluster25
2023-09-29 by CTI Intrinsec from Intrinsec
2023-05-07 by Matthew from Twitter (@embee_research)
2023-04-16 by Sergei Frankoff from OALabs
2023-04-10 by Check Point from Check Point
2023-04-07 by Salim Bitam from Elastic
2023-03-30 by Saharsh Agrawal from loginsoft
2023-03-23 by Anish Bogati from Logpoint
2023-03-16 by Cedric Pernet from Trend Micro
2023-01-30 by Arie Olshtein from Checkpoint
2023-01-16 by Francesco Bussoletti from Difesa & Sicurezza
2022-12-18 by Guy Bruneau from SANS ISC
2022-11-21 by Malwarebytes from Malwarebytes
2022-11-16 by Splunk Threat Research Team from splunk
2022-11-09 by Edmund Brumaghin from Cisco Talos
2022-09-23 by Roman Dedenok from Kaspersky
2022-09-15 by Threat & Detection Research Team from Sekoia
2022-09-13 by Jeff White from Palo Alto Networks Unit 42
2022-08-29 by wanghao from 360 netlab
2022-08-17 by Counter Threat Unit ResearchTeam from Secureworks
2022-07-30 by cocomelonc from
2022-07-20 by Cert-UA from Cert-UA
2022-07-12 by Kyle Krejci from Team Cymru
2022-05-19 by The BlackBerry Research & Intelligence Team from Blackberry
2022-05-19 by The BlackBerry Research & Intelligence Team from Blackberry
2022-05-12 by Tyler Halfpop from Palo Alto Networks Unit 42
2022-05-05 by Threat Intelligence Team from Malwarebytes Labs
2022-04-20 by cocomelonc from cocomelonc
2022-04-15 by CIS from Center for Internet Security
2022-04-12 by Check Point Research from Check Point
2022-03-31 by Debashis Pal from APNIC
2022-03-26 by Tony Lambert from forensicitguy
2022-03-25 by State Service of Special Communication and Information Protection of Ukraine (CIP) from GOV.UA
2022-03-07 by James Slaughter from Fortinet
2022-03-07 by Cyber Emergency Center from LAC WATCH
2022-03-04 by Alina Bizga from Bitdefender
2022-03-04 by Bill Toulas from Bleeping Computer
2022-02-23 by 360 Threat Intelligence Center from Weixin
2022-02-06 by Tony Lambert from forensicitguy
2022-02-02 by Ghanshyam More from Qualys
2022-01-25 by Yaron Samuel from Palo Alto Networks Unit 42
2022-01-24 by Gustavo Palazolo from Netskope
2022-01-24 by Proofpoint from Proofpoint
2022-01-21 by Gameel Ali from MalGamy
2022-01-12 by MalGamy from
2022-01-12 by Guillaume Orlando from
2022-01-03 by Tony Lambert from forensicitguy
2021-12-31 by Jan Kopriva from InfoSec Handlers Diary Blog
2021-12-30 by Brad Duncan from InfoSec Handlers Diary Blog
2021-12-20 by Jan Kopriva from InfoSec Handlers Diary Blog
2021-12-17 by Luigi Martire from Yoroi
2021-12-08 by Jiří Vinopal from YouTube ( DuMp-GuY TrIcKsTeR)
2021-12-06 by muzi from MalwareBookReports
2021-12-02 by ASEC Analysis Team from AhnLab
2021-11-22 by Jiří Vinopal from YouTube ( DuMp-GuY TrIcKsTeR)
2021-11-22 by Jiří Vinopal from YouTube ( DuMp-GuY TrIcKsTeR)
2021-11-16 by Luigi Martire from Yoroi
2021-11-12 by Dominik Degroot from Living Code
2021-11-02 by Dmitry Melikov from InQuest
2021-10-06 by Jordan Herman from zimperium
2021-09-15 by Telsy from Telsy
2021-09-08 by Paul Kimayong from Juniper
2021-09-06 by cocomelonc from cocomelonc
2021-07-28 by Jennifer Grob from RiskIQ
2021-07-24 by Xavier Mertens from InfoSec Handlers Diary Blog
2021-07-12 by Melissa Frydrych from IBM
2021-07-12 by Melissa Frydrych from Cipher Tech Solutions
2021-06-29 by Luigi Martire from Yoroi
2021-06-24 by Diana Lopera from Trustwave
2021-06-24 by The BlackBerry Research and Intelligence Team from Blackberry
2021-06-11 by Fuying Laboratory from NSFOCUS
2021-06-04 by Xiaopeng Zhang from Fortinet
2021-06-02 by Sean Gallagher from Sophos
2021-05-18 by AhmedS Kasmani from Youtube (AhmedS Kasmani)
2021-05-11 by VMRay Labs Team from VMRay
2021-05-11 by Microsoft Security Intelligence from Twitter (@MsftSecIntel)
2021-05-07 by Nadav Lorber from Morphisec
2021-05-05 by Aniruddha Dolas from Zscaler
2021-04-21 by Sean Gallagher from SophosLabs Uncut
2021-04-04 by Mahmoud Morsy from menshaway blogspot
2021-03-17 by HP Bromium from HP
2021-02-28 by PWC UK from PWC UK
2021-02-25 by Minerva Labs from Minerva
2021-02-12 by Rodel Mendrez from Trustwave
2021-02-12 by Xavier Mertens from InfoSec Handlers Diary Blog
2021-02-11 by Jan Kopriva from InfoSec Handlers Diary Blog
2021-01-21 by Markel Picado from DENEXUS
2021-01-11 by Matías Porolli from ESET Research
2021-01-09 by Marco Ramilli from Marco Ramilli's Blog
2021 by SecureWorks from Secureworks
2020-12-21 by JON MUNSHAW from Cisco Talos
2020-12-18 by Matthew Camacho from Trend Micro
2020-12-15 by Aaron Riley from Cofense
2020-12-10 by US-CERT from US-CERT
2020-12-07 by Proofpoint Threat Research Team from Proofpoint
2020-12-04 by Chris Campbell from Inde
2020-12-03 by Telsy Research Team from Telsy
2020-11-27 by Alex Holland from HP
2020-11-18 by G-Data from G Data
2020-11-18 by Sophos from Sophos
2020-11-05 by Michael Gorelik from Morphisec
2020-10-16 by Hornetsecurity Security Lab from Hornetsecurity
2020-10-05 by Paul Kimayong from Juniper
2020-09-03 by Mario Henkel from Medium mariohenkel
2020-08-27 by MalWatch from MalWatch
2020-08-26 by Jagaimo Kawaii from Lab52
2020-08-10 by Pavankumar Chaudhari from Seqrite
2020-08-10 by Jim Walter from SentinelOne
2020-07-30 by Spamhaus Malware Labs from Spamhaus
2020-06-02 by James Haughom from Lastline Labs
2020-05-23 by Xavier Mertens from InfoSec Handlers Diary Blog
2020-05-22 by Luigi Martire from Yoroi
2020-05-14 by Markel Picado from SophosLabs
2020-04-16 by Hossein Jazi from Malwarebytes
2020-04-15 by Suraj Malhotra from
2020-04-14 by Adrian McCabe from Palo Alto Networks Unit 42
2020-04-13 by Suraj Malhotra from
2020-04-05 by Anurag from MalwrAnalysis
2020-03-24 by Wes Smiley from RiskIQ
2020-03-18 by Axel F from Proofpoint
2020-02-26 by Maciej Kotowicz from MalwareLab.pl
2020-02-02 by Sean Gallagher from Sophos Labs
2020 by SecureWorks from Secureworks
2019-09-26 by Bryan Campbell from Proofpoint
2019-07-15 by Edmund Brumaghin from Cisco Talos
2018-04-18 by Counter Threat Unit ResearchTeam from Secureworks
2018-04-05 by Xiaopeng Zhang from Fortinet
2018-01-12 by Rémi Jullian from Stormshield
2017-09-25 by Jeff White from Palo Alto Networks Unit 42
2017-06-28 by Xiaopeng Zhang from Fortinet
2016-08 by Deepen Desai from Zscaler
Tool: Agent Tesla
Names: Agent Tesla, AgentTesla, AgenTesla, Origin Logger, Negasteal
Description: (Fortinet) FortiGuard Labs recently captured some malware which was developed using the Microsoft .Net framework. I analyzed one of them, it's a new variant from AgentTasla family. In this blog, I’m going to show you how it is able to steal information from a victim’s machine. The malware was spread via a Microsoft Word document that contained an auto-executable malicious VBA Macro.
Category: Malware
Type: Keylogger, Info stealer
Information: https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html
Information: https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/
Information: https://researchcenter.paloaltonetworks.com/2017/09/unit42-analyzing-various-layers-agentteslas-packing/
Information: https://www.zscaler.com/blogs/research/agent-tesla-keylogger-delivered-using-cybersquatting
Information: https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html
Information: https://thisissecurity.stormshield.com/2018/01/12/agent-tesla-campaign/
Information: https://blogs.forcepoint.com/security-labs/part-two-camouflage-netting
Information: https://www.deepinstinct.com/2020/07/02/agent-tesla-a-lesson-in-how-complexity-gets-you-under-the-radar/
Information: https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/
Information: https://www.area1security.com/blog/facemask-phishing-agent-tesla-malware/
Information: https://www.deepinstinct.com/2020/10/29/the-hasty-agent-agent-tesla-attack-uses-hastebin/
Information: https://cofense.com/strategic-analysis-agent-tesla-expands-targeting-and-networking-capabilities/
Information: https://news.sophos.com/en-us/2021/02/02/agent-tesla-amps-up-information-stealing-attacks/
Information: https://www.riskiq.com/blog/external-threat-management/agent-tesla-trend-analysis/
Information: https://securityaffairs.co/wordpress/123039/malware/agent-tesla-c2c-dumped.html
Information: https://www.fortinet.com/blog/threat-research/fake-purchase-order-used-to-deliver-agent-tesla
Information: https://unit42.paloaltonetworks.com/excel-add-ins-malicious-xll-files-agent-tesla/
Information: https://unit42.paloaltonetworks.com/malicious-compiled-html-help-file-agent-tesla/
Information: https://cofense.com/blog/the-rise-of-agent-tesla-understanding-the-notorious-keylogger/
Information: https://www.fortinet.com/blog/threat-research/agent-tesla-variant-spread-by-crafted-excel-document
Mitre-attack: https://attack.mitre.org/software/S0331/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:AgentTesla
Playbook: https://pan-unit42.github.io/playbook_viewer/?pb=agent-tesla
Last-card-change: 2023-09-06
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1566.001 PHISHING : SPEARPHISHING ATTACHMENT the primary delivered mechanism for agent tesla is through email phishing messages. | T1203 EXPLOITATION FOR CLIENT EXECUTION agent tesla has exploited office vulnerabilities such as cve-2017-11882 and cve-2017-8570 for execution during delivery. T1053.005 SCHEDULED TASK/JOB : SCHEDULED TASK agent tesla has achieved persistence via scheduled tasks. T1204.002 USER EXECUTION : MALICIOUS FILE agent tesla has been executed through malicious e-mail attachments T1047 WINDOWS MANAGEMENT INSTRUMENTATION agent tesla has used wmi queries to gather information from the system. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER agent tesla can add itself to the registry as a startup program to establish persistence. T1053.005 SCHEDULED TASK/JOB : SCHEDULED TASK agent tesla has achieved persistence via scheduled tasks. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER agent tesla can add itself to the registry as a startup program to establish persistence. T1055.012 PROCESS INJECTION : PROCESS HOLLOWING agent tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. T1053.005 SCHEDULED TASK/JOB : SCHEDULED TASK agent tesla has achieved persistence via scheduled tasks. | T1140 DEOBFUSCATE/DECODE FILES OR INFORMATION agent tesla has the ability to decrypt strings encrypted with the rijndael symmetric encryption algorithm. T1564.003 HIDE ARTIFACTS : HIDDEN WINDOW agent tesla has used processwindowstyle.hidden to hide windows. T1562.001 IMPAIR DEFENSES : DISABLE OR MODIFY TOOLS agent tesla has the capability to kill any running analysis processes and av software. T1027 OBFUSCATED FILES OR INFORMATION agent tesla has had its code obfuscated in an apparent attempt to make analysis difficult. agent tesla has used the rijndael symmetric encryption algorithm to encrypt strings. T1055.012 PROCESS INJECTION : PROCESS HOLLOWING agent tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. T1218.009 SYSTEM BINARY PROXY EXECUTION : REGSVCS/REGASM agent tesla has dropped regasm.exe onto systems for performing malicious activity. T1497 VIRTUALIZATION/SANDBOX EVASION agent tesla has he ability to perform anti-sandboxing and anti-virtualization checks. | T1555 CREDENTIALS FROM PASSWORD STORES agent tesla has the ability to steal credentials from ftp clients and wireless profiles. T1555.003 CREDENTIALS FROM PASSWORD STORES : CREDENTIALS FROM WEB BROWSERS agent tesla can gather credentials from a number of browsers. T1552.001 UNSECURED CREDENTIALS : CREDENTIALS IN FILES agent tesla has the ability to extract credentials from configuration or support files. T1552.002 UNSECURED CREDENTIALS : CREDENTIALS IN REGISTRY agent tesla has the ability to extract credentials from the registry. | T1087.001 ACCOUNT DISCOVERY : LOCAL ACCOUNT agent tesla can collect account information from the victim’s machine. T1082 SYSTEM INFORMATION DISCOVERY agent tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, os, and video card from the system. T1016 SYSTEM NETWORK CONFIGURATION DISCOVERY agent tesla can collect the ip address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings. T1497 VIRTUALIZATION/SANDBOX EVASION agent tesla has he ability to perform anti-sandboxing and anti-virtualization checks. | T1560 ARCHIVE COLLECTED DATA agent tesla can encrypt data with 3des before sending it over to a c2 server. T1185 BROWSER SESSION HIJACKING agent tesla has the ability to use form-grabbing to extract data from web data forms. | T1071.003 APPLICATION LAYER PROTOCOL : MAIL PROTOCOLS agent tesla has used smtp for c2 communications. T1105 INGRESS TOOL TRANSFER agent tesla can download additional files for execution on the victim’s machine. | T1048.003 EXFILTRATION OVER ALTERNATIVE PROTOCOL : EXFILTRATION OVER UNENCRYPTED NON-C2 PROTOCOL agent tesla has routines for exfiltration over smtp, ftp, and http. |