Sophisticated Phishing Campaign Deploying Agent Tesla, OriginBotnet, and RedLine Clipper

Sep 12, 2023THNEndpoint Security / Malware

A blase phishing run is utilizing a Microsoft Word papers lure to administer a trifecta of threats, namely Agent Tesla, OriginBotnet, and OriginBotnet, to stitchery a wide scope of accusation from compromised Windows machines.

"A phishing email delivers the Word papers arsenic an attachment, presenting a deliberately blurred representation and a counterfeit reCAPTCHA to lure the recipient into clicking connected it," Fortinet FortiGuard Labs researcher Cara Lin said.

Clicking connected the representation leads to the transportation of a loader from a distant server that, successful turn, is designed to administer OriginBotnet for keylogging and password recovery, RedLine Clipper for cryptocurrency theft, and Agent Tesla for harvesting delicate information.

The loader, written successful .NET, employs a method called binary padding by adding null bytes to summation the file's size to 400 MB successful an effort to evade detection by information software.

The activation of the loader triggers a multi-stage process to found persistence connected the big and extract a dynamic-link room (DLL) that's liable for unleashing the last payloads.

One among them is RedLine Clipper, a .NET executable for stealing cryptocurrencies by tampering with the user's strategy clipboard to substitute the destination wallet code with an attacker-controlled one.

"To transportation retired this operation, RedLine Clipper utilizes the 'OnClipboardChangeEventHandler' to regularly show clipboard changes and verify if the copied drawstring conforms to the regular expression," Lin said.

Agent Tesla, connected the different hand, is simply a .NET-based distant entree trojan (RAT) and information stealer for gaining archetypal entree and exfiltrating delicate accusation specified arsenic keystrokes and login credentials utilized successful web browsers to a command-and-control (C2) server implicit SMTP protocol.

Also delivered is simply a caller malware dubbed OriginBotnet, which packs successful a wide scope of features to cod data, found communications with its C2 server, and download supplementary plugins from the server to execute keylogging oregon password betterment functions connected compromised endpoints.

Achieved MFA? PAM? Service relationship protection? Find retired however well-equipped your enactment genuinely is against individuality threats

"The PasswordRecovery plugin retrieves and organizes the credentials of assorted browser and bundle accounts," Lin said. "It records these results and reports them via HTTP POST requests."

It's worthy noting that Palo Alto Networks Unit 42, successful September 2022, elaborate an Agent Tesla successor called OriginLogger, which comes with akin features arsenic that of OriginBotnet, suggesting that they could beryllium some the enactment of the aforesaid menace actor.

"This cyberattack run [...] progressive a analyzable concatenation of events," Fortinet said. "It began with a malicious Word papers distributed via phishing emails, starring victims to download a loader that executed a bid of malware payloads. The onslaught demonstrated blase techniques to evade detection and support persistence connected compromised systems."

Found this nonfiction interesting? Follow america connected Twitter  and LinkedIn to work much exclusive contented we post.