Friday, November 27, 2020
Home Lead Story Agent Tesla Malware Being Delivered Through Hacking Scams, Exploiting MS Office Vulnerablilities

Agent Tesla Malware Being Delivered Through Hacking Scams, Exploiting MS Office Vulnerablilities

One MS Office vulnerability allows the attacker to run arbitrary code and after successful exploitation to deliver the Agent Tesla payload

As coronavirus-related hacking scams gain steam, Pune-based Quick Heal Security Labs on Wednesday said it has observed Agent Tesla malware being delivered through such malicious campaigns to steal sensitive data by capturing keystrokes, taking screenshots and dumping browser passwords.

Actors behind this campaign are capitalizing on the global coronavirus panic to distribute Agent Tesla malware and steal sensitive user information. Agent Tesla is currently exploiting Microsoft MS office vulnerabilities, titled CVE-2017-11882 and CVE-2017-8570, as well as archives with double extension executable (ZIP, RAR etc.).

Please Follow NewsGram on Twitter To Get Latest Updates From Around The World!

One MS Office vulnerability allows the attacker to run arbitrary code and after successful exploitation to deliver the Agent Tesla payload. This dropped payload performs code injection in known windows process RegAsm.exe.

“The injected code in RegAsm.exe performs all info-stealing activity and sends it to the CnC server. The RTF file is highly obfuscated with several invalid control words and whitespaces,” informed the research team. The .NET payload is downloaded from CVE-2017-11882 exploit.

Hackers
As coronavirus-related hacking scams gain steam, Pune-based Quick Heal Security Labs on Wednesday said it has observed Agent Tesla malware being delivered through such malicious campaigns to steal sensitive data by capturing keystrokes, taking screenshots and dumping browser passwords. Pixabay

When the execution begins, it starts decrypting the resource section where the malicious code is stored. Using the process-injection method, it injects its code to a genuine Microsoft file, RegAsm.exe to bypasses security products. “The purpose of this payload is to steal sensitive data, log user keys and to send this data to the SMTP server,” the Quick Heal team added.

Another MS Office vulnerability triggers the execution of scripts without user interaction. The .NET payload is downloaded by the CVE-2017-8750 exploit. The purpose of this payload is to steal sensitive data, log user keys and send data to the SMTP server.

ALSO READ: India, Home to World’s Oldest Civilizations Showcases the Culinary Traditions of The Indus Valley Civilization

“Quick Heal advises users to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails,” the company said in a statement. Users should also keep their Operating System updated and have a full-fledged security solution installed on all devices. The research team said it is proactively monitoring all campaigns related to COVID-19 and working relentlessly to ensure the safety of customers. (IANS)

STAY CONNECTED

19,120FansLike
362FollowersFollow
1,780FollowersFollow

Most Popular

Goddess Sati: The Hindu Goddess Of Marital Felicity And Longevity

Goddess Sati, also known as Dakshayani who is the Hindu Goddess of power and longevity. Sati was the daughter of Daksha, so she is called...

50 Percent Of Anemia Worldwide Is Due To Iron Deficiency: Report

According to the National Family Health Survey, in India, more than 50 percent of children, women of reproductive age, and pregnant women suffer from...

Mandarin Oriental Hotel Group Pledges To Eliminate Single-Use Plastic

One of the leading hotel chains in the world, Mandarin Oriental Hotel Group had pledged to eliminate all single-use plastic, across its portfolio of...

Report: 78% Adults Indians Make A Conscious Effort To Build Immunity

The underlying message from COVID-19 was loud and clear if your immune system is weak or if you are suffering from any lifestyle disease...

The New F&B Destination Of Gurugram- The RYU Resto-Bar At 32nd Milestone

With delectable sushi platters to signature cocktails that leave you wanting more, RYU, a new Asian-themed bar, and diner in Gurugram's popular dining destination...

Tips To Help You Navigate The New Rules Of Dating In 2020

Single Indians are now ready to dip their toes back into dating in real life (IRL) as India unlocks. However, how does one do...

How To Become A Poker Pro

By Carol Trehearn Whether you’re completely new to the game of poker and are really enjoying the games you’ve played so far, or have spent...

A Buying Guide For Lanyards Amid COVID-19

By Cathy Carter COVID-19 has changed the way the world operates. Unimaginable lifestyle changes are adopted. You would have never thought of something as drastic...

Recent Comments