Fortinet researchers uncovered a Spanish-speaking targeted phishing campaign delivering a new Agent Tesla variant. The campaign uses a chained Office exploit flow (CVE-2017-0199 and CVE-2017-11882) with a fileless loader that downloads and runs PowerShell/JavaScript to install Agent Tesla and exfiltrate data over FTP. #AgentTesla #CVE-2017-0199 #CVE-2017-11882 #Thunderbird #FTP
Keypoints
- Campaign targets Windows users with a Spanish-language phishing email containing a disguised Excel attachment (Figure 1).
- Exploits CVE-2017-0199 in the Excel document to trigger code execution and load a crafted RTF document.
- CVE-2017-11882 (Equation Editor) used to enable remote code execution via documents containing crafted equation data.
- A fileless loader module downloads Agent Tesla and runs it inside a suspended AddInProcess32 process using process hollowing.
- The malware includes anti-analysis checks (debugger, VM/sandbox, AV DLLs) and exits if it detects virtualization or analysis tools.
- Credentials are stolen from over 80 apps (Chromium/Mozilla browsers, Thunderbird, email clients, FTP clients, VPNs, etc.) and email contacts are harvested from Thunderbird.
- Stolen data is submitted to an FTP server (ftp.fosna.net) using the STOR command, with logs and HTML-formatted data files.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The phishing email delivered via a disguised Excel attachment: ‘The phishing email looks like a standard SWIFT transfer notification from a large financial institution with a disguised Excel attachment.’
- [T1203] Exploitation for Client Execution – CVE-2017-0199 in the Excel document is used to execute code: ‘The Excel document is in OLE format with crafted embedded data that exploits the CVE-2017-0199 vulnerability.’
- [T1203] Exploitation for Client Execution – CVE-2017-11882 is exploited via Office documents to execute code: ‘CVE-2017-11882 is an RCE vulnerability in Microsoft Office’s Equation Editor… can be exploited by Excel, Word, PowerPoint, and RTF documents…’
- [T1059.001] PowerShell – JavaScript/PowerShell loader code is used after shellcode execution: ‘PowerShell code’s purpose includes…’
- [T1055.012] Process Hollowing – The loader uses process hollowing to run Agent Tesla in AddInProcess32.exe: ‘process hollowing on the process that it copies the Agent Tesla executable into and executes it within the “AddInProcess32.exe” process.’
- [T1497] Virtualization/Sandbox Evasion – Anti-analysis checks and environment detection: ‘It performs detections… Windows API CheckRemoteDebuggerPresent… checks for virtualization…’
- [T1027.001] Data Encoding: Base64 – JavaScript/PowerShell payloads are base64-encoded and decoded: ‘base64-encoded PowerShell code.’
- [T1555.003] Credentials in Web Browser – Exfiltrates saved credentials from Chromium/Mozilla browsers and other apps: ‘It steals saved credentials from some web browsers…’
- [T1041.003] Exfiltration Over FTP – Submits stolen data to an FTP server via STOR: ‘submits the stolen data it has harvested from the victim’s device to an FTP server using the “STOR” method.’
- [T1060] Registry Run Keys/Startup Folder – Persistence mechanism described (though disabled in this variant): ‘adding itself to the auto-run group in the system’s registry.’
- [T1106] Native API – Process creation with CreateProcessA for suspended process: ‘CreateProcessA() with the creation flags of 0x80000004 (CREATE_SUSPENDED).’
- [T1059.005] Windows Script Host – JavaScript execution via WScript.exe: ‘the Windows program WScript.exe is called to execute the JS file.’
Indicators of Compromise
- [URL] Malicious resources – hxxps[:]//ilang[.]in/QqBbmc, hxxp[:]//equalizerrr[.]duckdns[.]org/eveningdatingforeveryone.js
- [URL] Additional script/loader links – hxxps[:]//paste[.]ee/d/yWWXG
- [URL] Image-hosted/executable delivery – hxxps[:]//uploaddeimagens[.]com[.]br/images/004/773/812/original/js.jpg?1713882778
- [FTP] Command-and-control/exfiltration – ftp[.]fosna.net
- [SHA-256] Sample hashes – 8406A1D7A33B3549DD44F551E5A68392F85B5EF9CF8F9F3DB68BD7E02D1EABA7, 208AF8E2754A3E55A64796B29EF3A625D89A357C59C43D0FF4D2D30E20092D74, 7230CC614270DCA79415B0CF53A666A219BEB4BEED90C85A1AC09F082AEA613B, A1475A0042FE86E50531BB8B8182F9E27A3A61F204700F42FD26406C3BDEC862