Agent Tesla spyware spreads via Microsoft Word documents

Costea Lestoc By: Costea Lestoc
2 minute read
Agent Tesla spyware microsoft word

Home » News » Agent Tesla spyware spreads via Microsoft Word documents

Agent Tesla malware got spread via Microsoft Word documents last year, and now it came back to haunt us. The latest variant of the spyware asks the victims to double-click on a blue icon to enable a clearer view in a Word document.

If the user is careless enough to click on it, this will result in the extraction of an .exe file from the embedded object into the system’s temporary folder and then run it. This is only an example of how this malware works.

The malware is written in the MS Visual Basic

The malware is written in the MS Visual Basic language, and it was analyzed by Xiaopeng Zhang who posted the detailed analysis on his blog on April 5th.

The executable file found by him was called POM.exe, and it’s a sort of installer program. When this ran, it dropped two files named filename.exe and filename.vbs into the %temp%subfolder. To make it run automatically at startup, the file adds itself to the system registry as a startup program, and it runs %temp%filename.exe.

The malware creates a suspended child process

When filename.exe starts, this will lead to the creation of a suspended child process with the same that in order to protect itself.

After this, it will extract a new PE file from its own resource to overwrite the child process’ memory. Then, the resuming of the child process’ execution comes.

The malware drops a daemon program

The malware also drops a Daemon program from the .Net program’s resource called Player into the %temp% folder and runs it up to protect filename.exe. The daemon’s program name is made up of three random letters, and its purpose is clear and simple.

The primary function receives a command line argument, and it saves it to a string variable that’s called filePath. After this, it will create a thread function via which it checks to see if filename.exe is running every 900 milliseconds. If filename.exe is killed, it will run again.

Zhang said that FortiGuard AntiVirus detected the malware and eliminated it. We recommend that you go through Zhang’s detailed notes to find out more about the spyware and how it works.

RELATED STORIES TO CHECK OUT:

Discussions

Next up

Download Windows 10 KB4491101 to fix OS stability issues

Rabia Noureen avatar. By: Rabia Noureen
2 minute read

Microsoft just released cumulative update KB4491101 for those who are running Windows 10 V1507 (RTM version). The update is just restricted to the users of Windows 10 […]

Continue Reading

This version of Office has been deprovisioned [FIXED]

Rabia Noureen avatar. By: Rabia Noureen
4 minute read

It is certainly annoying to face issues in your system when you have to finish off the most important task that has been assigned by […]

Continue Reading

Windows 10 v1809 KB4482887 lands next Tuesday

Irfa Batool avatar. By: Irfa Batool
2 minute read

Microsoft is planning to rollout Cumulative Update KB4482887 for Windows 10 version 1809 next week. For the time being, the update is available only for Preview […]

Continue Reading