A recent Total Oil themed campaign being used to distribute the AgentTesla malware. The campaign begins with a phishing email masquerading as an order request from a Liberian oil company employee. Under this guise, the attacker attempts to convince a user to open a Word document and enable macro execution. If successful, an obfuscated VBA macro fulfils its purpose of decoding and executing a PowerShell script. The PowerShell script is responsible for de-obfuscating a C# source code snippet that is subsequently compiled and loaded within that PowerShell process. Once loaded, one of the methods within the C# code is invoked, specifically the one responsible for downloading and executing a malicious payload from a remote URL. This payload was identified to be a .NET loader. Prior to loading the malware, the loader performs a series of anti-sandbox and anti-debugging techniques to exit the program if any related conditions are met. If all checks pass, an executable embedded in the loader is run in a new thread. Analysis revealed that the loaded file is an Agent Tesla keylogger that has significant code overlap with the Hawkeye malware. After establishing persistence via a Registry Run key, the malware performs its ultimate goal of retrieving credentials stored within various applications, such as web browsers, FTP clients, and file downloaders. The malware is capable of using the .NET API to set up a mail client that is used for exfiltrating the harvested credentials to the attacker via SMTP.
Malware Hash (MD5/SHA1/SH256)