AgentTesla Delivered Through Fake Business Proposal Emails and a Multi-Stage Loader
Summary
ASEC analyzed phishing emails delivering AgentTesla through a ZIP attachment and multi-stage .NET loaders disguised as café and Microsoft tools. The infostealer targets credentials and other data; its FTP destination is server356[.]Web-hosting[.]Com.
Key points
- The phishing email poses as a business proposal and urges recipients to review a product list in an attached ZIP file.
- The ZIP contains an EXE disguised as café-management software; embedded bitmap resources conceal data used to reconstruct and load .NET stages in memory.
- A later loader masquerades as Microsoft PC Manager, copies itself to %APPDATA%\AH.Exe, and decrypts the final payload.
- The final payload is AgentTesla, which collects credentials, cookies, and contact information from browsers, email clients, FTP, and VPN programs.
- AgentTesla checks the public IP address and whether the environment is a hosting server; the reported FTP destination is server356[.]Web-hosting[.]Com.
- ASEC advises verifying sender addresses and checking email attachments and links before opening or entering sensitive information.
Article Details
- Attack Vectors
- Phishing emails disguised as requests to review a business proposal prompt recipients to open an attached ZIP file containing a malicious EXE.
- The EXE uses a café-management-program disguise and bitmap resources to reconstruct and load successive .NET payloads in memory.
- The final AgentTesla payload steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN programs.
- Defensive Notes
- Verify that the sender's email address belongs to an official domain.
- Inspect suspicious links and attachments, including unexpected executable or script file extensions, before opening them.
- Verify that a page uses the official site's URL before entering sensitive information; do not enter information when the page is in doubt.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | server356[.]web-hosting[.]com | AgentTesla FTP destination reported as its C2. |
bbl@anmarinee[.]it[.]com | Username configured for AgentTesla's reported FTP C2 destination. | |
| MD5 | 8777a9b0533660fddc2a73b819638c18 | MD5 indicator listed in the article's malware-analysis section. |
| MD5 | cbcc4ba1a1485cb01a4b65fc7915e629 | MD5 indicator listed in the article's malware-analysis section. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article identifies an FTP C2 destination for AgentTesla, but does not specify the exact data-transfer behavior.T1059.001 · PowerShellThe malware copies its running loader to %APPDATA%\AH.Exe.T1140 · Deobfuscate/Decode Files or InformationLoaders decrypt or reconstruct embedded .NET payloads from bitmap resources and encrypted byte arrays.T1204.002 · Malicious FileRecipients are prompted to open the attached ZIP and execute the contained EXE.T1539 · Steal Web Session CookieAgentTesla collects browser cookies.T1555.003 · Credentials from Web BrowsersAgentTesla collects credentials and cookies stored in browsers.T1566.001 · Spearphishing AttachmentThe campaign distributes malware through phishing emails with a ZIP attachment.T1620 · Reflective Code LoadingThe loaders load reconstructed .NET DLLs and payloads into memory.
Malware
Vendors
Products
Kingsoft security softwarethe Fee bitmap disguises itself as a legitimate file by labeling its product information as “Kingsoft security software.” Kingsoft.EventManagement.ListenerAuthenticator.ListenAccessibleListener() function extractsMicrosoft PC Managerthat disguises itself as a legitimate system management tool, with the assembly title set to “Microsoft PC Manager,” the product name set to “PC Manager,” and the company name set to “Microsoft Corporation.” At the