Friday, August 14, 2020
Home Lead Story Agent Tesla Malware Being Delivered Through Hacking Scams, Exploiting MS Office Vulnerablilities

Agent Tesla Malware Being Delivered Through Hacking Scams, Exploiting MS Office Vulnerablilities

One MS Office vulnerability allows the attacker to run arbitrary code and after successful exploitation to deliver the Agent Tesla payload

As coronavirus-related hacking scams gain steam, Pune-based Quick Heal Security Labs on Wednesday said it has observed Agent Tesla malware being delivered through such malicious campaigns to steal sensitive data by capturing keystrokes, taking screenshots and dumping browser passwords.

Actors behind this campaign are capitalizing on the global coronavirus panic to distribute Agent Tesla malware and steal sensitive user information. Agent Tesla is currently exploiting Microsoft MS office vulnerabilities, titled CVE-2017-11882 and CVE-2017-8570, as well as archives with double extension executable (ZIP, RAR etc.).

Please Follow NewsGram on Twitter To Get Latest Updates From Around The World!

One MS Office vulnerability allows the attacker to run arbitrary code and after successful exploitation to deliver the Agent Tesla payload. This dropped payload performs code injection in known windows process RegAsm.exe.

“The injected code in RegAsm.exe performs all info-stealing activity and sends it to the CnC server. The RTF file is highly obfuscated with several invalid control words and whitespaces,” informed the research team. The .NET payload is downloaded from CVE-2017-11882 exploit.

Hackers
As coronavirus-related hacking scams gain steam, Pune-based Quick Heal Security Labs on Wednesday said it has observed Agent Tesla malware being delivered through such malicious campaigns to steal sensitive data by capturing keystrokes, taking screenshots and dumping browser passwords. Pixabay

When the execution begins, it starts decrypting the resource section where the malicious code is stored. Using the process-injection method, it injects its code to a genuine Microsoft file, RegAsm.exe to bypasses security products. “The purpose of this payload is to steal sensitive data, log user keys and to send this data to the SMTP server,” the Quick Heal team added.

Another MS Office vulnerability triggers the execution of scripts without user interaction. The .NET payload is downloaded by the CVE-2017-8750 exploit. The purpose of this payload is to steal sensitive data, log user keys and send data to the SMTP server.

ALSO READ: India, Home to World’s Oldest Civilizations Showcases the Culinary Traditions of The Indus Valley Civilization

“Quick Heal advises users to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails,” the company said in a statement. Users should also keep their Operating System updated and have a full-fledged security solution installed on all devices. The research team said it is proactively monitoring all campaigns related to COVID-19 and working relentlessly to ensure the safety of customers. (IANS)

STAY CONNECTED

18,953FansLike
362FollowersFollow
1,780FollowersFollow

Most Popular

Here’s How an Online Training Helped me Land my Dream Job

About the Author: Apurva Bhalerao is a postgraduate in Mechatronics. She joined Internshala Trainings for Internet of Things training. She shares how an online...

Internships for Students With Good People Skills

College students, especially the first and second year ones, often hesitate to apply to internships for the reason that they don’t have any job-specific...

73% Females in Rajasthan Facing Issues in Procuring Sanitary Napkins During Lockdown

Seven of every 10 adolescent females, nearly 73 per cent, in Rajasthan say they have had a problem procuring sanitary pads during lockdown in...

I Believe Dance is like Talking Without Speaking: Govinda

Actor Govinda sees dancing more like talking, sans words. "I believe that dance is more like talking without having to actually speak or use words....

Google Search to Provide you With Necessary Information About Floods in India

Google is already sending public alerts to people hit by flooding in India and users in India can now use Search to simply enter...

Yoga Improves Symptoms of Generalised Anxiety Disorder: Researchers

Researchers have suggested that yoga improves symptoms of generalised anxiety disorder, a condition with chronic nervousness and worry, suggesting the popular practice may be...

Young Women More Stressed Than Men During Lockdown: Survey

A recent survey on the impact of the Covid-19 pandemic on people between 10 and 24 years in UP, Bihar and Rajasthan has revealed...

Doctors Estimated 3 Folds Rise in Deaths of Patients During Lockdown Due to “Waitlist Mortality”

By Ashish Srivastava The nationwide lockdown imposed from March 24 has affected services across sectors, and key areas of medical care were also not left...

Recent Comments