Agent Tesla malware exploiting MS Office vulnerabilities: Report
text_fields
New Delhi: As coronavirus-related hacking scams gain steam, Pune-based Quick Heal Security Labs on Wednesday said it has observed Agent Tesla malware being delivered through such malicious campaigns to steal sensitive data by capturing keystrokes, taking screenshots and dumping browser passwords.
Actors behind this campaign are capitalizing on the global coronavirus panic to distribute Agent Tesla malware and steal sensitive user information.
Agent Tesla is currently exploiting Microsoft MS office vulnerabilities, titled CVE-2017-11882 and CVE-2017-8570, as well as archives with double extension executable (ZIP, RAR etc.).
One MS Office vulnerability allows the attacker to run arbitrary code and after successful exploitation to deliver the Agent Tesla payload.
This dropped payload performs code injection in known windows process RegAsm.exe.
"The injected code in RegAsm.exe performs all info-stealing activity and sends it to the CnC server. The RTF file is highly obfuscated with several invalid control words and whitespaces," informed the research team.
The .NET payload is downloaded from CVE-2017-11882 exploit.
When the execution begins, it starts decrypting the resource section where the malicious code is stored.
Using the process-injection method, it injects its code to a genuine Microsoft file, RegAsm.exe to bypasses security products.
"The purpose of this payload is to steal sensitive data, log user keys and to send this data to the SMTP server," the Quick Heal team added.
Another MS Office vulnerability triggers the execution of scripts without user interaction. The .NET payload is downloaded by the CVE-2017-8750 exploit. The purpose of this payload is to steal sensitive data, log user keys and send data to the SMTP server.
"Quick Heal advises users to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails," the company said in a statement.
Users should also keep their Operating System updated and have a full-fledged security solution installed on all devices.
The research team said it is proactively monitoring all campaigns related to COVID-19 and working relentlessly to ensure the safety of customers.
