Contents

• Overview
• About AgentTesla Stealer
• Context behind the sample
• Initial Phishing
• Analyzing Malicious Payload
  • Browsers
  • Keylogger and Clipboard Logger
  • Email Data
  • System Information
  • Social Messaging Apps
  • FTP data
  • VPN data
  • Miscellaneous
• Exfiltration
• IOCs
• YARA Rule
• MITRE ATT&CK

Overview

In this blog, we’ll take a closer look at a recent sample of the AgentTesla stealer that’s being spread through malicious emails. We’ll see how the main payload is cleverly hidden inside a legitimate file to stay under the radar. Then, we’ll walk through how to unpack these files so you can dig into and understand the malicious data inside.

About AgentTesla Stealer

AgentTesla is a .NET-based malware that’s been active in the wild since 2016. Over the years, it has evolved by improving its features and techniques for stealing data. One of the key changes is how it hides its malicious payload more effectively. Earlier versions of AgentTesla were mainly spread through .doc files, zip archives, Office macros, and various Microsoft Office vulnerabilities , all delivering malicious .NET binaries.

Context behind the sample

A recent campaign of malicious emails is spreading worldwide. One example of such an email is shown below:

In this blog, we analyze one such sample. The file arrives inside a zip archive named New Order-588576.gz. As the name suggests, it’s pretending to be related to an online shopping app or something legitimate to trick the user. However, the zip file actually contains malicious files designed to steal user data.

Below is the flowchart showing the sequence of files loaded after extracting the zip archive:

Initial Phishing

The victim receives the zip file as the initial phishing attempt. Inside the zip is a JavaScript file named New Order-588576.jse, which looks legitimate just based on the file name.

After analyzing the .jse file, we discovered that it downloads obfuscated data from a GitHub server at this URL:

hxxps://gist[.]githubusercontent[.]com/Zankop/a097612584eb987221fd35adefb65b50/raw/1115d45273a10e20fa009032d53e29c8dc5f4b91/gistfile1.txt

The file’s contents look like encrypted strings, but the script itself contains the code to decrypt them. So, at runtime, the file decrypts itself using the provided function, and it turns out to be a binary .NET executable.

While generating the .NET file, the script creates an instance named B and loads the file from there. Upon analyzing the file in dnSpy, we can see that the entry point of the executable starts from the function B().

After debugging the file, we noticed that it loads another binary at runtime. One of the variables that obfuscated with a random-looking name holds the entire file content, which only gets loaded during execution. This extracted binary turns out to be the main payload of AgentTesla, which we’ll analyze in the next section.

Analyzing Malicious Payload

Browsers

Chromium

It goes through a list of Chromium-based browsers and looks for specific folders, such as "Local State." It then attempts to extract and steal data like URLs, usernames, and passwords.

The main payload is delivered through a .NET file. Upon analysis, we found that the payload itself is also a .NET executable. In the following section, we will examine the types of data the stealer collects after the system is infected.

Flock Browser

It searches for the APPDATA folder to locate the path \\Flock\\Browser\\, from which it attempts to steal data. Specifically, it targets the signons3.txt file, which contains sensitive information related to the browser.

Internet Explorer/Edge

The stealer extracts data such as the host, username, and password associated with the browser.

These GUIDs represent different types of Windows credentials, such as secure notes, web passwords, domain credentials, and others. They can be accessed and used by various Windows components and applications, including browsers, third-party apps, and system services.

Mozilla Browser

Mozilla Firefox stores user credentials and profile information across several key files. For instance, logins.json contains encrypted login credentials, while key4.db holds the decryption key required to access that data. The stealer actively searches for these files and also targets profiles.ini, which provides information about all user profiles configured in the browser.

UC Browser

The stealer targets the folder located at LocalApplicationData under the path "UCBrowser\\". It searches for files containing sensitive information such as URLs, usernames, and passwords. Stealer attempts to extract one specific file wow_logins.db that is used to store saved login credentials.

The stealer also searches for the following browsers and attempts to retrieve sensitive data from them:

Epic Privacy : Epic Privacy Browser\\User Data

Torch Browser : Torch\\User Data

360 Browser : 360Chrome\\Chrome\\User Data

IceDragon : \\Comdo\\IceDragon\\

Chromium : Chromium\\User Data

CentBrowser : CentBrowser\\User Data

PaleMoon : \\Moonchild Productions\\Pale Moon\\

Brave : BraveSoftware\\Brave-Browser\\User Data

Postbox : \\Postbox\\

Edge Chromium : Microsoft\\Edge\\User Data

Thunderbird : \\Thunderbird\\

WaterFox : \\WaterFox\\

CoolNovo : MapleStudio\\ChromePlus\\User Data

Orbitum : Orbitum\\User Data

Sputnik : Sputnik\\Sputnik\\User Data

Kometa : Kometa\\User Data

Coowon : Coowon\\Coowon\\User Data

Liebao Browser : liebao\\User Data

Uran : uCozMedia\\Uran\\User Data

QIP SURF : QIP Surf \\User Data

7Star : 7Star\\7Star\\User Data

Sleipnir6 : Fenric Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer

Firefox : \\Mozilla\\Firefox\\

Chrome : Google\\Chrome\\User Data

Comodo Dragon : Comodo\\Dragon\\User Data

Coccoc : CocCoc\\Browser\\User Data

Amigo : Amigo\\User Data

CyberFox : \\8pecxstudios\\Cyberfox\\

K-Meleon : \\K-Meleon\\

Iridium Browser : Iridium\\User Data

Vivaldi : Vivaldi\\User Data

Flock : \\Flock\\Browser\\

Opera Browser : Opera Software\\Opera Stable

BlackHawk : \\NETGATE Technologies\\BlackHawk\\

Chedot : Chedot\\User Data

SeaMonkey : \\Mozilla\\SeaMonkey\\

Elements Browser : Elements Browser\\User Data

IceCat : \\Mozilla\\icecat\\

Citrio : CatalinaGroup\\Citrio\\User Data

Yandex Browser : Yandex\\YandexBrowser\\User Data

QQ Browser : Tencent\\QQBrowser\\User Data

Falkon Browser : \\falkon\\profiles\\

Keylogger and Clipboard Logger

The stealer sets up a system to record all keystrokes entered by the user. If clipboard logging is enabled, it also monitors anything copied to the clipboard, such as passwords or other sensitive information. A timer runs at set intervals to process and handle the collected data.

Email Data

Becky!

The code is designed to extract stored email credentials from the Becky! Internet Mail client developed by RimArts. It looks for email data in the registry path HKEY_CURRENT_USER\Software\RimArts\B2\Settings and targets the RimArts B2 email client to steal email information stored in the Folder.lst file.

The process starts by checking for Becky!’s configuration file, Mailbox.ini, located in the application’s data directory. The script then extracts the SMTP server and email address from this file.

Eudora

The script also looks for a folder in the registry path Software\Qualcomm\Eudora\CommandLine to steal information from the Eudora email client.

Claws Mail

The script extracts saved email credentials from the Claws Mail client by reading its configuration files. It first gets the salt and PBKDF2 iteration count from the clawsrc file to recreate the encryption key. Then, it collects account details like SMTP server and email address from accountrc. The encrypted passwords are read from passwordstorerc.

Outlook

The stealer scans the Windows Registry for saved email passwords from different versions of Microsoft Outlook and Windows Messaging. It looks specifically for entries like "IMAP Password," "POP3 Password," "SMTP Password," and "HTTP Password" inside Outlook profile folders.

Fox Mail

The stealer search for these registry entries to locate the installation paths of Foxmail and its preview version FoxmailPreview :

HKEY_CURRENT_USER\\Software\\Aerofox\\FoxmailPreview

HKEY_CURRENT_USER\\Software\\Aerofox\\Foxmail\\V3.1

It then searches for user data. It checks multiple places, including standard installation folders and virtualized directories like VirtualStore, to find where Foxmail stores mail or account information. The code targets two specific files Account.rec0 and Account.stg which hold saved email credentials .

The stealer also searches for other email applications, such as the ones listed below:

Pocomail : \\Pocomail\\accounts.ini

Opera Mail : \\Opera Mail\\Opera Mail\\wand.dat

The Bat! : \\The Bat!\\Account.CFN

Mailbird : \\Mailbird\\Store\\Store.db

IncreddiMail : Software\\IncrediMail\\Identities\\

eM Client : eM Client\\\\accounts.dat

System Information

It collects information about the infected device, including the computer name, operating system, IP address, username, RAM size, processor name, and more. All these details are then stored together in an array.

Social Messaging Apps

Trillian

The script extracts saved account credentials from Trillian by reading and decrypting the accounts.dat file in the user’s AppData folder. It parses the decrypted data to find account names and passwords, decrypts the passwords, and stores them in a list.

Paltalk

This script steals saved login credentials for the Paltalk application from the Windows Registry. It accesses the path:

HKEY_CURRENT_USER\\Software\\A.V.M.\\Paltalk NG\\common_settings\\core\\users\\creds\\

There, it locates saved Paltalk login details, decrypts the passwords, and stores all the information.

Discord

The stealer extracts Discord session data by targeting all files with .log and .ldb extensions. It specifically steals database information from LevelDB folders, including both the main Discord and DiscordPTB versions.

Pidgin

The stealer searches for the file \\.purple\\accounts.xml in the AppData folder and extracts data such as protocol, username, and password.

Psi/Psi+

The stealer looks for the XMPP client in the \\Psi\\profiles directory within the AppData folder and searches for the accounts.xml file to extract sensitive information.

FTP data

WinSock File Transfer Protocol

The stealer retrieves login credentials such as the host, username, and password from WS_FTP configuration files. It searches for the file located at Ipswitch\WS_FTP\Sites\ws_ftp.ini within the AppData folder.

The malware gains access to the WS_FTP configuration files by extracting and decrypting the stored FTP login credentials using the _wsftpkey and _iv encryption keys.

SmartFTP

It searches the following path within the AppData folder:

SmartFTP\\Client 2.0\\Favorites\\Quick Connect

The file located at this path contains sensitive information, including the server address (host), port number, username, connection protocol (such as FTP, SFTP, or FTPS), password, and other related data.

FTPGetter

It searches for the following path in the AppData\Roaming directory:

\\FTPGetter\\servers.xml

Once located, it extracts data such as the server IP address, username, and password.

WinSCP

The stealer searches for all session entries of the client from the following registry path:

SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions

It uses the OpenSubKey function to access each subkey and then proceeds to extract data such as the Host Name, User Name, Password, Public Key File, Port Number, and Private Key File.

Flash FXP

For credential extraction, the stealer looks for two specific files in the AppData\Roaming folder:

sites.dat : This file contains details such as the Site Name, Hostname/IP address, Port Number, Protocol used (FTP, SFTP, FTPS), Username, and Password (which may be encrypted or obfuscated).

quick.dat : This file stores information about temporary or recent connections made using the Quick Connect feature.

FTP Navigator

The script searches the SystemDrive for the following path:

\\FTP Navigator\\Ftplist.txt

It then retrieves information including the server address, username, and password.

VPN data

OpenVPN

The script extracts saved OpenVPN GUI credentials including usernames and passwords from the Windows Registry by accessing the following path:

HKEY_CURRENT_USER\\Software\\OpenVPN-GUI\\configs\\

It iterates through each VPN profile under this key and retrieves data such as the VPN profile name, associated username, and password.

NordVPN

The script looks through folders with names like "NordVpn.exe" to find a config file called user.config. This file usually holds app settings. Once it finds it, the code reads the XML and tries to pull out the Username and Password values.

Miscellaneous

Capturing User Display

The stealer captures a screenshot of whatever is currently visible on the victim’s screen. It takes the screenshot with a specified height and width, then saves the image in bitmap format.

Apple Data

The stealer targets Apple-related configuration and credential data stored on a Windows system. It looks for two specific files: plutil.exe and keychain.plist. The plutil.exe file is a tool used to parse Apple’s property list files. The stealer uses it to read the contents of keychain.plist, which contains saved credentials, authentication tokens, or user preferences associated with Apple applications such as iTunes or iCloud.

Windows Credential Manager

The script Searches the following folders for credential-related files:

%AppData%\\Microsoft\\Credentials\\

%LocalAppData%\\Microsoft\\Credentials\\

It also checks the corresponding DPAPI Protect folder located at:

%AppData%\\Microsoft\\Protect\\<SID>

These files contains sensitive data including network credentials, Remote Desktop credentials, Windows login credentials, and other credentials saved by applications that use Windows Data Protection APIs (DPAPI).

DynDNS credentials

This script reads a DynDNS configuration file such as config.dyndns to extract the stored username and encrypted password.

Virtual Network Computing server

The stealer specifically targets various VNC (Virtual Network Computing) server software installations to extract stored passwords from the Windows Registry.

It targets multiple versions of popular VNC applications, including RealVNC (versions 3.x and 4.x), TightVNC, UltraVNC, and TigerVNC. It then attempts to retrieve any saved VNC passwords.

Internet Download Manager

Internet Download Manager (IDM) is a file management tool for Windows. The stealer searches the Windows Registry at the following location:

HKEY_CURRENT_USER\\Software\\DownloadManager

From this registry key, it attempts to extract the stored username and password.

Exfiltration

The stealer captures a screenshot from the victim’s device and saves it in JPEG format. The file is named using the following pattern : SC_<computer name>_<Date time>_.jpeg

The stealer proceeds to extract keylogger data and saves it in the format : KL_<computer name>_<Date time>_.html

It also collects system and user-related information such as hardware details, OS version, username, and other environment data and stores it in a separate file using the format :PW_<computer name>_<Date time>_.html

After logging into the FTP server at ftp://ftp[.]srv[.]server-phsperu[.]net, it’s pretty clear that it’s being used to store all the data stolen from victims.

IOCs

Category	Fields
Zip File	141fc33b17d0caf647bd9c9f3a3bfed7c1df4c1f5e8dafd6f1374e1603bdea6a
JavaScript File	316df21cdd8fcdc5e12d936ac2c2620e67d360d3953e9658fad87ed66b364147
Text File	hxxps://gist[.]githubusercontent[.]com/Zankop/a097612584eb987221fd35adefb65b50/raw/1115d45273a10e20fa009032d53e29c8dc5f4b91/gistfile1.txt
.NET File	435cccb7a2c836432dce2c2ab085a7b124a9bd94e6682fa6788cf6456484396d
Final Payload .NET File	ce705a5fbfbda584e9c6160bbd57d6c3721dddd497e2a405da63d34e9b6a256c
C2 Server (FTP Server)	ftp://ftp[.]srv[.]server-phsperu[.]net

YARA Rule

MITRE ATT&CK

Tactic	Technique	Description
Initial Access	Spearphishing Attachment (T1566.001)	Victim receives a malicious .gz archive via email, disguised as a legitimate order confirmation.
Defense Evasion	Obfuscated Files or Information (T1027)	The payload downloaded from GitHub is obfuscated to avoid detection.
Defense Evasion	Decode Files or Information (T1140)	The script decrypts the obfuscated content at runtime to reconstruct the .NET binary.
Credential Access	Credential Dumping (T1003)	Extracts saved credentials such as usernames and passwords from various applications and browsers.
Credential Access	Input Capture: Keylogging (T1056.001)	Implements a keyboard hook to capture user keystrokes for harvesting sensitive information.
Discovery	File and Directory Discovery (T1083)	Searches specific directories and registry paths for sensitive files containing credentials.
Credential Access	Credentials from Windows Credential Manager (T1555.004)	Accesses credential files stored in %AppData%\Microsoft\Credentials\
Collection	Screen Capture (T1113)	Takes screenshots of the victim's screen
Collection	System Information Discovery (T1082)	Gathers detailed system info such as computer name, OS version
Exfiltration	Exfiltration Over Alternative Protocol (T1048)	Uses FTP to upload stolen data from the victim's system to a remote server