Rewterz Threat Alert – Agent Tesla Email Campaign Stealing Information

Severity

Medium

Analysis Summary

An email campaign discovered distributing the Agent Tesla malware. A potential victim receives an email with a subject of “Re: Revised INV/ GF76370-7478-465”. The sender was observed as “Weifang Huaxing admin[@]infozcn[.]com”. Within the body of the email, the adversary attempts to entice a user to open the attachment “INV-GF76370-7478-465.cab” to review the order. The infection process begins once the .cab attachment is opened (which extracts to INV-GF76370-7478-465.exe) ultimately leading to the Agent Tesla keylogger / infostealer being installed on the victim’s system. It is interesting to note that the email server (infozcn.com) does match where the sender claimed to have sent the message from, according to analysis of the email headers. This helped the email to pass through most authentication checks undetected.

Impact

Infostealer keylogger

Indicators of Compromise

Filename

INV-GF76370-7478-465.cab

Email Address

admin@infozcn[.]com

Email Subject

Re: Revised INV/ GF76370-7478-465

Malware Hash (MD5/SHA1/SH256)

• 8e69c2cc66803246bc16bba746b17afa08aacc37d751857fa8ad0653b08f0771
• b6dcffb6187476b0bfcc3bea59b56155ff0d0e02fd8aca6ae1d2d9baa02b1031
• 88187071e1f8b6f17b093888a03ed574a39bb84f
• 80217c27c16ed71c1d9f29b4d456f9f2

Remediation

• Block all threat indicators at your respective controls
• Always be suspicious about emails sent by unknown senders
• Never click on the link/ attachments sent by the unknown senders