This investigation details an active Agent Tesla campaign targeting Chilean and broader LATAM enterprises with procurement-themed phishing, using a multi-stage loader, process hollowing, and fileless execution to steal credentials and exfiltrate them over FTP. The campaign has reused the same infrastructure for at least 18 months and leveraged compromised legitimate services and .NET Reactor-protected components to evade detection. #AgentTesla #ALTERNATE.dll #ftp.horeca-bucuresti.ro #aspnet_compiler.exe
Keypoints
- Agent Tesla was delivered through a RAR archive named Orden de compra_pdf.uu, a Spanish-language purchase order lure aimed at Chilean and broader LATAM businesses.
- The infection chain used a JScript encoded dropper, PowerShell stagers, and process hollowing into aspnet_compiler.exe to execute the payload in memory.
- The loader ALTERNATE.dll was protected with .NET Reactor 6.x, control-flow obfuscation, virtualization, and anti-decompilation measures.
- The payload stole browser, email, FTP, VPN, VNC, and messaging credentials, while also capturing keystrokes, clipboard data, and screenshots.
- Exfiltration occurred over cleartext FTP to ftp.horeca-bucuresti.ro / 89.39.83.184, using a structured HTML report naming pattern.
- The same infrastructure had been active since at least mid-2024, with over 80 related samples observed and strong focus on Spanish-speaking Latin American targets.
- The article recommends interactive sandboxing, outbound FTP monitoring, and targeted awareness training for finance and procurement teams.
MITRE Techniques
- [T1566.001 ] Phishing: Spearphishing Attachment – The attack began with a malicious RAR attachment delivered as a finance/procurement lure [‘RAR archive with financial lure delivered via email’]
- [T1027 ] Obfuscated Files or Information – The dropper used a JScript Encoded Script and fake extensions to hinder inspection [‘JScript Encoded .jse dropper evades AV’; ‘unusual extension is intended to confuse automated scanners’]
- [T1059.007 ] JavaScript – The .jse dropper was executed by Windows Script Host via wscript.exe [‘wscript.exe executes .jse dropper’]
- [T1059.001 ] PowerShell – PowerShell stagers were launched with execution policy bypass to run payloads [‘Stager with -ExecutionPolicy Bypass’]
- [T1055.012 ] Process Hollowing – ALTERNATE.dll injected Agent Tesla into aspnet_compiler.exe to run inside a trusted process [‘ALTERNATE.dll injected into aspnet_compiler.exe’]
- [T1027.002 ] Software Packing – The loader used .NET Reactor 6.x virtualization and control flow obfuscation to resist static analysis [‘.NET Reactor 6.x with VM + control flow obfuscation’]
- [T1555.003 ] Credentials from Web Browsers – The payload accessed Chrome and Firefox credential stores to steal saved passwords [‘Chrome, Firefox credential store access confirmed’]
- [T1048.003 ] Exfiltration Over Alternative Protocol: FTP – Stolen data was sent to a cleartext FTP server for collection [‘Cleartext FTP to ftp.horeca-bucuresti.ro:21’]
- [T1082 ] System Information Discovery – The stealer enumerated CPU, RAM, OS version, hostname, and username before exfiltration [‘CPU, RAM, OS version enumeration pre-exfil’]
- [T1016 ] System Network Configuration Discovery – The malware queried ip-api.com to fingerprint the victim’s network context [‘External IP lookup via ip-api.com’]
Indicators of Compromise
- [SHA256 ] RAR dropper / campaign archive – 948C8C69FE02EDA9231AEBFA5C626335307058AC74A5C3C40B346179A1BFC982, 7929355856A2A85D48F95D230CD74FBB5AD554BED49E73B1800136C4BCCCD1A8
- [MD5 ] RAR dropper / decrypted payload reference – A7EEEAD9C868D9944ED1C1F113328F32, 78ba57f4a164bedc26204296ea09bb8f
- [SHA1 ] RAR dropper – B50B3800B17AD7AD5C4483C0B6B24D1D151A9D10
- [IPv4 ] FTP C2 / victim fingerprinting – 89.39.83.184, 208.95.112.1
- [FQDN ] FTP exfiltration hostname – ftp.horeca-bucuresti.ro
- [FTP account ] Operator drop account – [email protected]
- [File path / regex ] Dropped stager files and persistence copy – C:Temp[A-Z]{8}.ps1, 7bcd610d-7af6-4dc2-875b-dc4fec91463c.exe
- [File name / pattern ] Social-engineering and exfiltration naming patterns – Orden de compra_pdf.uu, PW_[user]-[host]_[timestamp].html
- [Binary strings ] Internal loader identifiers – ALTERNATE.dll, ALTERNATE.pdb
Read more: https://any.run/cybersecurity-blog/agent-tesla-latam-enterprise/