Rewterz Threat Alert – AgentTesla Delivered via a Malicious PowerPoint Add-In

Severity

Medium

Analysis Summary

Attackers are always trying to find new ways to deliver malicious code to their victims. Microsoft Word and Excel are documents that can be easily weaponized by adding malicious VBA macros. Today, they are one of the most common techniques to compromise a computer. Especially because Microsoft implemented automatically executed macros when the document is opened. In Word, the macro must be named AutoOpen(). In Excel, the name must be Workbook_Open(). However, PowerPoint does not support this kind of macro.

Document disguised as a PowerPoint template (with the extension ‘.pot’) delivered within a classic phishing email. It was not a template but an add-in. PowerPoint supports ‘add-ins’ developed by third parties to add new feature.

Impact

Exposure of sensitive data

Indicators of Compromise

MD5

• eec80c5c7f0defbc3139dd03ae3b38aa

SHA-256

• d46615754e00e004d683ff2ad5de9bca976db9d110b43e0ab0f5ae35c652fab7
• b345b73a72f866ac3bc2945467d2678ca4976dd4c51bd0f2cdb142a79f56210a

SHA1

• 03f7e0089feb51ea507c2c8ba334cb944cf3a27e

Remediation

Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
Never click on the links/attachments sent by unknown senders.