Begin typing your search above and press return to search.
Schools breeding hatred
access_time 14 Sep 2023 10:37 AM GMT
access_time 16 Aug 2023 5:46 AM GMT
When ‘Jai Sree Ram’ becomes a death call
access_time 15 Feb 2024 9:54 AM GMT
Strengthening the Indian Republic
access_time 26 Jan 2024 4:43 AM GMT
When the US and UK fight Houthis
access_time 17 Jan 2024 6:08 AM GMT
Homechevron_rightTechnologychevron_rightAgent Tesla malware...

Agent Tesla malware exploiting MS Office vulnerabilities: Report


New Delhi: As coronavirus-related hacking scams gain steam, Pune-based Quick Heal Security Labs on Wednesday said it has observed Agent Tesla malware being delivered through such malicious campaigns to steal sensitive data by capturing keystrokes, taking screenshots and dumping browser passwords.

Actors behind this campaign are capitalizing on the global coronavirus panic to distribute Agent Tesla malware and steal sensitive user information.

Agent Tesla is currently exploiting Microsoft MS office vulnerabilities, titled CVE-2017-11882 and CVE-2017-8570, as well as archives with double extension executable (ZIP, RAR etc.).

One MS Office vulnerability allows the attacker to run arbitrary code and after successful exploitation to deliver the Agent Tesla payload.

This dropped payload performs code injection in known windows process RegAsm.exe.

"The injected code in RegAsm.exe performs all info-stealing activity and sends it to the CnC server. The RTF file is highly obfuscated with several invalid control words and whitespaces," informed the research team.

The .NET payload is downloaded from CVE-2017-11882 exploit.

When the execution begins, it starts decrypting the resource section where the malicious code is stored.

Using the process-injection method, it injects its code to a genuine Microsoft file, RegAsm.exe to bypasses security products.

"The purpose of this payload is to steal sensitive data, log user keys and to send this data to the SMTP server," the Quick Heal team added.

Another MS Office vulnerability triggers the execution of scripts without user interaction. The .NET payload is downloaded by the CVE-2017-8750 exploit. The purpose of this payload is to steal sensitive data, log user keys and send data to the SMTP server.

"Quick Heal advises users to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails," the company said in a statement.

Users should also keep their Operating System updated and have a full-fledged security solution installed on all devices.

The research team said it is proactively monitoring all campaigns related to COVID-19 and working relentlessly to ensure the safety of customers.

Show Full Article
News Summary - Agent Tesla malware exploiting MS Office vulnerabilities: Report
Next Story