Hackers Exploiting Old Microsoft Office RCE Flaw to Deploy Agent Tesla Malware

It has been reported that malicious individuals are utilizing a malware called Agent Tesla to target Microsoft Office users using versions affected by CVE-2017-11882 XLAM.

This malware is taking advantage of a remote code execution vulnerability in Equation Editor, which is present in Microsoft Office and known as CVE-2017-11882.

Remote code execution (RCE) is a type of cyberattack where an attacker uses a remote computer or network to execute malicious code without requiring user data.

Sensitive information can be accessed remotely through a code execution vulnerability, without requiring physical network access by hackers.

It is important to be aware of spam emails that contain malicious attachments. Hackers often use this technique to inject harmful programs onto a user’s device.

Once the user downloads and opens the attachment, the malicious program is activated, potentially causing harm to the device and compromising sensitive information.

According to the Zscaler report, if a user downloads and views a malicious attachment on a vulnerable version of Microsoft Excel, the Excel file will connect to a negative location and start downloading other files without requiring any further action from the user.

Variable names in the VBS file are 100 characters long, which complicates the deobfuscation and analysis process. The JPG file contains a malicious Base64-encoded DLL.

After the JPG file is downloaded, the VBS file initiates the execution of a PowerShell executable. This executable then retrieves a DLL in Base64-encoded form from the image file. The DLL is subsequently decoded, and its malicious procedures are loaded.

PowerShell performs the main operation for reading and writing the registry. After this, the DLL injects a thread into the main function, which retrieves the Agent Tesla payload.

Agent Tesla attempts to install hooks for both the clipboard and keyboard to monitor and record every keystroke that the user types and collect data from the user’s copied information.

Agent Tesla employs a technique known as window hooking to monitor users’ keystrokes, mouse movements, and event messages. The function of the malicious actor ceases before the user can react.

A Telegram bot controls the threat actor who receives the data exfiltrated from the virus. To protect our information, we must keep ourselves informed about cyber threats and stay updated.