Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email

Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to review a business proposal. The email body asks recipients to review the attached product list and reply with their feedback on inventory and pricing, thereby prompting users to download and open the attached ZIP file.

• Attachment: {Company Name} LIST.ZIP

 

[Figure 1] Phishing email body

 

The ZIP file contains an EXE file rather than a document file. The .NET assembly information for this file includes a description in Chinese stating that it is a program for café operations, menus, orders, and ingredient management, and it also contains UI code designed to disguise itself as a café management program.

 

[Figure 2] Malicious EXE file contained within the ZIP file

 

[Figure 3] Disguised as a café management program

 

The ProjectCafe.Form1.InitializeComponent() function extracts the RGB values for each pixel of the Resources.Fee bitmap to reconstruct the Data. It then combines the split strings to call Assembly.Load and load the reconstructed .NET DLL into memory. It then passes values—each of which hides “HATA,” “yjw,” and “ProjectCafe” as hexadecimal strings—as call arguments and executes public methods through reflection.

 

[Figure 4] Fee Resource Load Code

 

[Figure 5] Fee Resource

 

The DLL restored from the Fee bitmap disguises itself as a legitimate file by labeling its product information as “Kingsoft security software.” Kingsoft.EventManagement.ListenerAuthenticator.ListenAccessibleListener() function extracts “HATA” and “yjw” from the passed hexadecimal string, then reads the top-left 471×471-pixel area from the HATA bitmap in ProjectCafe.Properties.Resources. It then converts the pixel data into a byte array, performs XOR decryption using a yjw-based key to restore the .NET file, and loads it into memory through AppDomain.Load.

 

[Figure 6] Kingsoft security software disguised loader

 

[Figure 7] Code for accessing the HATA resource

 

[Figure 8] HATA resource

 

The restored next-stage file is an obfuscated loader that disguises itself as a legitimate system management tool, with the assembly title set to “Microsoft PC Manager,” the product name set to “PC Manager,” and the company name set to “Microsoft Corporation.” At the start of execution, it copies the currently running original file to %APPDATA%\AH.Exe; if a file with the same name already exists, it skips the copying process. The AH.Exe file created at this point is a copy of the original loader, not the final AgentTesla. Subsequently, the PC_Manager.Logging.LoggerMapper.WaitForEfficientMap() function reads an encrypted byte array from the 8VXmw2w resource. The subsequent decryption routine performs byte operations using the UTF-8 key ZIyStAzSE and then removes the last byte to restore the final .NET payload.

 

[Figure 9] Code for loading the 8VXmw2w resource

 

[Figure 10] Encrypted 8VXmw2w resource

 

The malware ultimately executed is AgentTesla, an Infostealer. It collects credentials, cookies, and contact information stored in browsers, email clients, FTP, and VPN programs, and also includes functionality to query the public IP address and verify whether the execution environment is a hosting server.

AgentTesla C2

• FTP Destination: server356.Web-hosting.Com
• Protocol: FTP
• FTP User: BBL@anmarinee.It.Com
• FTP Password: RJ~R9Na5]krI2D&=

[Figure 11] AgentTesla malware

 

Response Guide

1. Verify the Sender

• Verify that the sender’s email address belongs to an official domain.

2. Check Hyperlinks and Attachments

• If the email body contains an image that prompts you to click on it, check the linked URL first before clicking. Suspicious URLs often lead through non-official paths before finally redirecting to a legitimate page, so you should examine them carefully. Additionally, if there are attachments, check for suspicious file extensions (.Exe, .Vbs, .Js, etc.).

3. Be Cautious When Entering Sensitive Information

• If you are asked to provide sensitive information, such as login credentials, always verify that the page’s URL is that of the official site before entering any information. If the page is not official, it is highly likely to be a suspicious URL, so caution is required. In particular, check the page’s security certification (HTTPS, padlock icon) before entering sensitive information, and never enter any information if you have any doubts.

MD5

8777a9b0533660fddc2a73b819638c18

cbcc4ba1a1485cb01a4b65fc7915e629