• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2020-7298 – McAfee Total protection security bypass
August 10, 2020
Rewterz Threat Alert – TA551 (Shathak) Word docs push IcedID (Bokbot)
August 11, 2020

Rewterz Threat Alert – Agent Tesla Old RAT Uses New Tricks to Stay on Top

August 11, 2020

Severity

Medium

Analysis Summary

Agent Tesla is, at its core, a keylogger and information stealer. First discovered in late 2014, there has been steady growth in the use of Agent Tesla over the last 1-2 years. The malware was initially sold in various underground forums and marketplaces, as well as it’s very own AgentTesla.com site (now defunct) Agent Tesla. The primary delivery mechanism for Agent Tesla is email (phishing messages). Attackers are often timely with their social engineering lures, and the current pandemic is not off limits to the attackers. In the last few months, attackers have been observed spreading Agent Tesla via COVID-themed messages, often masquerading as information information or updates from the WHO (World Health Organization).

Actors behind Agent Tesla campaigns have also used malicious Office documents to facilitate first-stage delivery. Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns. These and similar exploits allow for quick delivery and execution with minimal user interaction (beyond opening the malicious documents and allowing active content to proceed).

Over time, additional features have been added to Agent Tesla. These improvements include more robust spreading and injection methods as well as discovery and theft of wireless network details and credentials.

Impact

  • Credential theft
  • Information theft
  • Exposure of sensitive data 

Indicators of Compromise

MD5

  • a7772d0b18d4ab807881900ac626f7e7
  • 4ef2d073c2bc1e3f2673155f0ecc6d25
  • cf400f8fa702582e867d2f554c0fdf22
  • 994a246ae96622526ff88956874f6ee1
  • f5b4045d0f6ca45b5fe859bae8f370d0
  • 55ce840c876175975994d7c1c744888c
  • 59eecae993a95845f83b410d389aaa2e
  • 10a83eef0c8a82d8c0d355d86cd3f9e0
  • 054cad7b941f1153523212810fe3bb59
  • dea9c53aa9e4e875fa8ab4cb5c8e723c
  • 78576290fa4a53b428180616a02f0e03
  • bb90ad32ac3b8eade0b34709025314a6
  • 34d6bde00a9e785ed261af62f62b41f1

SHA-256

  • 1abf66ab839c550bc77d97d1644c1225935a86b9591e9a95bcd606ebec6bbc19
  • 7d1bcec8a3f71910e15cbb3adae945cd5096b7de259b51aef8f2e229bd4b40e2
  • f24018dead69b0f899d33e73f72f5c3ef6f3c391850484b06b042f36dbc08cac
  • 9b27388be292aea50d62cfebd130a9832f0d676feb28771d70d3e30bdb117f3a
  • b74bcc77983d587207c127129cfda146644f6a4078e9306f47ab665a86f4ad13
  • 7ec2b40879d6be8a8c6b6ba239d5ae547604ad2605de0d2501a4cca25915afa1
  • f44c6c8c1c81f9990f11a0f70e6517c358fc1ee00a78b32461d4a2594b48e47d
  • 648261052662b044dc233349ccdfa9dfd6853ec9a21ced386f8f172b2568b0d1
  • aa08d96a25908ce76e07475aefbbe192bd812665a5600dc30600688510dd033e
  • 0107fadc185fd6b53dc033d4a79e53ef1621ae623917de029b6c02eeae2021c1
  • 7adc0e8236262080e62c4bfb97e745880247f9e244ae8718e60cc217a3ae773b
  • 507b63c73ba3bee19c8c8afb40526c1196240376277f4b49e25bedc5d866b980
  • 70aecc29ffb60caf068e4d8107f4d53fcdbd333bed7ac6fb3a852b00e86ded31
  • a040efaf5dfac863805103ea0aa90a15b3690ad060188a15ea7d68491b274123
  • 4007480b1a8859415bc011e4981f49ce2ff7a7dd7e883fe70d9f304cbfefedea
  • 590c19542f6959d6424107eb4f2998b04d035575341b1f23a40dea6d82aecadd
  • 7ce7bf11f6285621381b80027c488e9b5009205131a89738975ccc89574a1533
  • be26ad023b732078c42b4f95067fb9107fe88aebd7ebbf852e7e968e50eee8a0
  • 9fee57918672137160499dcd1a099670ef8f9a787f3a1ad6d8123df26cddbc3b
  • 388386f3361138514c561dcf6169e8f9e8726c91e2dc66663efb07bf21ece052
  • e2473526523180f460af4d8e164df9060c9f328cc7c0bae5846d51b28c12febe

SHA1

  • 9e9c8ef7f20677795684b2749a59367cf5c3ec0a
  • 4ffa900d7cf3ae6414bf90f6c9a4667cedfd57dd
  • 83be2722b7adc91bc3ee219b75e9176bc7ce8e6e
  • 3e15c7c82b875c3553456dc08a8b79019cb48644
  • 3ce8f4bfeb99fa2fb8898c7664ad3838ce4a4fcf
  • a2ad3ec4cd2d70edf2bc9089c493f898b7da44a5
  • 72d3d907d7502c383ffc8239d255882838a5a6e4
  • 683efb5746e85867b5d613dc07a116a80becce58
  • 7e674dd61f0802316bc092ffd44f5b8a36ab26d5
  • 3390272bb793ad15a45d647c3e5a716145fd262a
  • 7cf661644a638dcb554a81ba490ddcaee2ed6f12
  • 8f841e8f7d2c3334145c8c9f89c8cd6929a06b2a
  • 6c2d55f7fcecdcae779b148f0060b8ab4062e0a9
  • 05d74461b2a63b75f319ef2c5c4aa074af4e97c3
  • 90fc8a737a7030db2e3583cbccb3156bb0a8ff12
  • 160c5583f9ba3d11e94a0dd8c9a64936981e8194
  • 5b744ce5d3cccd556d66704d8fdde882ea928829
  • 7617dc78df626d5df43e38506fa7c577baef4bc5
  • 8cd26c88b74f913f6e1c9d71a8d1e9aa53b7c6f6
  • 859f498f0ba963e468a3912d936ad8e7ec01dbcd
  • 94277994af62de5948d6de134edac0089a54b71e

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.