Friday, March 1, 2024

Hackers Exploiting Old Microsoft Office RCE Flaw to Deploy Agent Tesla Malware

It has been reported that malicious individuals are utilizing a malware called Agent Tesla to target Microsoft Office users using versions affected by CVE-2017-11882 XLAM.

This malware is taking advantage of a remote code execution vulnerability in Equation Editor, which is present in Microsoft Office and known as CVE-2017-11882.

Remote code execution (RCE) is a type of cyberattack where an attacker uses a remote computer or network to execute malicious code without requiring user data.

Sensitive information can be accessed remotely through a code execution vulnerability, without requiring physical network access by hackers.

It is important to be aware of spam emails that contain malicious attachments. Hackers often use this technique to inject harmful programs onto a user’s device.

Once the user downloads and opens the attachment, the malicious program is activated, potentially causing harm to the device and compromising sensitive information.

Spam with a malicious attachment
Spam with a malicious attachment

According to the Zscaler report, if a user downloads and views a malicious attachment on a vulnerable version of Microsoft Excel, the Excel file will connect to a negative location and start downloading other files without requiring any further action from the user.

Variable names in the VBS file are 100 characters long, which complicates the deobfuscation and analysis process. The JPG file contains a malicious Base64-encoded DLL.

After the JPG file is downloaded, the VBS file initiates the execution of a PowerShell executable. This executable then retrieves a DLL in Base64-encoded form from the image file. The DLL is subsequently decoded, and its malicious procedures are loaded.

PowerShell performs the main operation for reading and writing the registry. After this, the DLL injects a thread into the main function, which retrieves the Agent Tesla payload.

Agent Tesla attempts to install hooks for both the clipboard and keyboard to monitor and record every keystroke that the user types and collect data from the user’s copied information.

Agent Tesla employs a technique known as window hooking to monitor users’ keystrokes, mouse movements, and event messages. The function of the malicious actor ceases before the user can react.

A Telegram bot controls the threat actor who receives the data exfiltrated from the virus. To protect our information, we must keep ourselves informed about cyber threats and stay updated.


Latest articles

Golden Corral restaurant chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...

Hackers Hijack Anycubic 3D Printers to Display Warning Messages

Anycubic 3D printer owners have been caught off guard by a series of unauthorized...

RSM US Deploys Stellar Cyber Open XDR Platform to Secure Clients

Stellar Cyber, the innovator of Open XDR, today announced that RSM US – the leading provider...

Biden Crack Down Sale of Americans’ Personal Data to China & Russia

To safeguard the privacy and security of American citizens, President Joe Biden has issued...

Kali Linux 2024.1 Released – What’s New

Kali Linux recently released version 2024.1, the first release of the year 2024, with...

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles