{"id":17988,"date":"2022-02-02T10:18:28","date_gmt":"2022-02-02T18:18:28","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11721\/"},"modified":"2022-02-02T10:18:28","modified_gmt":"2022-02-02T18:18:28","slug":"news-11721","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11721\/","title":{"rendered":"Phishing Campaign Targeting Korean to Deliver Agent Tesla New Variant"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Threat\u00a0Research Report<\/b><\/p>\n

Affected platforms:<\/b>\u00a0Microsoft Windows
Impacted parties:<\/b>\u00a0 \u00a0 Windows Users
Impact:<\/b>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Collects sensitive information from victims\u2019 device
Severity level<\/b>: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Critical<\/p>\n

A phishing campaign was recently caught in the wild by Fortinet\u2019s FortiGuard Labs<\/a>, that delivers a malicious Microsoft PowerPoint file. The content of the phishing email,\u00a0\u00a0written in Korean, asks recipients to open the attached PowerPoint file to review a purchase order. I researched what this malicious file does once the PowerPoint file is opened and have been able to confirm that it is spreading a new variant of Agent Tesla.<\/p>\n

Over the past several years, we have captured and analyzed many Agent Tesla variants. It has been quite active since 2014 when it was first observed. Agent Tesla is a .Net-based malware<\/a> (developed in C#.Net, VB.Net, C++.Net, etc.) whose core function is to collect sensitive information from a victim\u2019s machine, including recording keystrokes and data on the system clipboard, stealing saved software credentials (browsers, mail clients, VPN, FTP, IM, etc.), stealing browser cookies files, and taking screenshots.\u00a0<\/p>\n

In this blog we will look at the phishing email, analyze the malicious macro contained in the attachment, show how the malware is updated and maintains persistence, examine the Agent Tesla payload, and show the ways it exfiltrates stolen data and credentials.\u00a0<\/p>\n

Let\u2019s start with how most cyberattacks begin \u2013 with a phishing email.<\/p>\n

The Phishing Email<\/h2>\n<\/p><\/div>\n