AgentTesla Stealer Delivered Via Weaponized PDF and CHM Files

AgentTesla, a notorious information stealer, is observed spreading via CHM and PDF Files, which covertly harvest critical information from the victim’s computer.

The stealer has features including keylogging, clipboard data capture, file system access, and data transfer to a Command and Control (C&C) server.

According to CRIL, its tactical changes maintain its serious threat to organizations and allow it to continue accessing priceless data.

Due to its adaptability, it may be used to exploit a variety of attack vectors, including email attachments, malicious URLs, and document-based intrusions.

FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Free Demo

AgentTesla Delivered Via CHM File

An AgentTesla infection begins on the victim’s computer by a PowerShell script retrieved through a spam email containing a CHM file. 

A lure is used in the specially designed CHM file. Based on the information in the CHM file, it appears to be aimed at people or organizations working in network engineering, telecommunications, or information technology.

This CHM file secretly downloads and runs a PowerShell script from the remote server when the user opens it. The PowerShell script conceals harmful code by using encoded binary strings.

The malicious PowerShell script drops a loader DLL file based on the .NET framework, which injects the AgentTesla payload into system executables.

AgentTesla Delivered Via PDF File

In this case, this PDF uses two different strategies to spread the infection. In the first technique, the PDF triggers a PowerShell command that loads the AgentTesla malware. 

The second technique shows a fake message when the PDF is accessed, and when users click the “Reload” button, a PPAM file is downloaded.

The PowerShell operations executed by this PPAM file download the AgentTesla malware.

Recommendations

• Use effective email filtering solutions to identify and stop spam, phishing scams, and harmful attachments.
• Avoid clicking on dubious links and opening email attachments.
• Install a trusted Internet security and antivirus software on all of your linked devices.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.