Analysis of New wave of .XLA Agent Tesla – Part 1

Agent Tesla sample analyzed is primarily an information stealer / password stealer spyware campaign, that has often been spread via spear phishing campaigns. Also, it’s a subscription-based malware (malware as a service), providing those who license it with a control panel to easily view and manage their illegally collected data.

Additionally, it has the ability to steal various types of sensitive information from an organization’s infected computers or any individuals to aggregate information from clipboards, collect system configurations, and even disable standard antivirus applications.

Remote Access Features of Agent Tesla

Agent Tesla is written in .NET and is designed to evade detection by security software. The RAT is packed with a commercial packer that makes it difficult for security software to analyze its behavior. Once the RAT is unpacked, it can be configured by the attacker to perform various tasks, including:

1. Keylogging: Agent Tesla can capture keystrokes from the victim’s computer, including login credentials and other sensitive information.
2. Screen capture: The RAT can take screenshots of the victim’s computer, allowing the attacker to view the victim’s activity on the computer.
3. Audio and video recording: Agent Tesla can record audio and video from the victim’s computer, allowing the attacker to listen in on conversations and view the victim’s activity.
4. Clipboard monitoring: The RAT can monitor the victim’s clipboard, allowing the attacker to capture any information copied to the clipboard, including login credentials and other sensitive information.
5. Password stealing: Agent Tesla can steal passwords saved in the victim’s browser, allowing the attacker to gain access to the victim’s online accounts.

Anti-Debugging Techniques

Agent Tesla also has a number of anti-analysis and anti-debugging techniques, built in to the code, that is employed to evade detection. The Agent Tesla RAT can detect, if it is being run in a virtual environment, or if it is being analyzed by a security researcher.

If Agent Tesla detects that it is being analyzed, it will terminate itself to avoid detection. Agent Tesla also uses Base64 to encode strings, and a custom encryption algorithm to encrypt its communication with the command and control server (C2 Server).

Infection Chain

Recently, the agent-Tesla malware has infected its victims by using .ps1 script to invoke the web request from the Blacklisted IPs. As usual, this can be done by initial infection vectors of spam emails. This kind of email contains Microsoft Office documents (Excel) of .XLA file which contains VBA macros to execute the automated task. The initial vectors may vary depending on their targets and we all know that the threat actors perform basic reconnaissance methodologies to decide their infection vector.

Sample Information

XLA: 026c54c38be34fc0438340416799d17dfa31c43ae0d4090177ca957661b80b58

Why .XLA is used?
XLA file extension is used by Microsoft Excel software to store program plugins. XLA file contains additional modules and functions that can be used to add features to spreadsheet documents or automate certain processes. XLA file can store VBA macros, which after activation can be run with key shortcuts and/or by using additional buttons accessed through the toolbar.

Also, anyone can generate customize XLA files directly in Microsoft Excel. To gain access to addons user must activate function that allows them to be used.

Technical Analysis of .XLA Document

Snap 1: Phishing .EML contains attachment

Snap 2: Attachment with macro-enable content

VBA Message Box

Usually, once we enabled the macro content of the sheet, it will execute the VBA macros. But this time, the macros will execute once the excel is closed (Sub Auto_Close).

File structure of the .XLA

VBA_Project functions & folders

Temp files

We all know that TEMP files (aka foo files) (.tmp) are temporary files that may be created by various software programs. It is typically generated while the program is running to temporarily store information, then is automatically deleted when the program is closed. The temp folder is a prime target for malware for several reasons. First, malware is often attached to or embedded in legitimate programs to perform malicious actions.

Workbook Content

Functions of VBA_Project

Process Tree of .XLA Document

The add-ins in the XLA file get installed silently without user knowledge. On seeing that there is no content in the document, the user will close the file but, in the backend macro code gets executed to initiate the malicious activity.

Indicators of Compromise for Agent Tesla sample:

MITRE ATT&CK Metrics:

Conclusion

Agent Tesla is a powerful RAT that is designed to steal sensitive information from victims’ computers. The RAT is designed to evade detection by security software and has a number of anti-analysis techniques that it uses to avoid detection. Agent Tesla has been used in a number of high-profile attacks and is commonly used in targeted attacks against individuals and small businesses. To protect against Agent Tesla, it is important to educate users on how to identify and avoid phishing emails. It is also important to keep security software up to date and to perform regular scans of your computer for malware. Finally, it is important to use strong and unique passwords for all online accounts and to enable two-factor authentication whenever possible.