{"id":1751,"date":"2024-09-25T06:36:54","date_gmt":"2024-09-25T06:36:54","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=1751"},"modified":"2025-07-29T03:12:30","modified_gmt":"2025-07-29T03:12:30","slug":"analysis-of-new-wave-of-ppam-agent-tesla-part-2","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/analysis-of-new-wave-of-ppam-agent-tesla-part-2\/","title":{"rendered":"Analysis of New wave of .PPAM Agent Tesla \u2013 Part 2"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

In the previous post<\/a>, we saw how the Agent Tesla malware has infected its victims<\/a> by using the PS1 Powershell script to invoke the web request from the blacklisted IPs. Agent Tesla\u2019s successful delivery method is through email, either in the form of spam or more targeted phishing campaigns with OPEC (Oil Production Export Countries) and a COVID-19-based theme, where the malware is sent as an attachment, a macro-enabled Microsoft document (.DOC,.XLA\/.XLS,.PPT file format), Microsoft document add-on files (.XLL), or a compressed archive. According to LMNTRIX CDC’s observations, there were reports of over 8000 customers delivering files infected with Agent Tesla RAT as recently as 2021\/22.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

This kind of email contains Microsoft Office documents (Excel) of .XLA\/.XLS files, but this sample uses the .PPAM extension, which contains VBA macros to execute and automate tasks. \u2018.PPAM\u2019 is an add-in file used by Microsoft PowerPoint where a program is used to develop slideshow presentations.<\/p>\n\n\n\n

It contains components that can provide additional functionality, including extra commands, customized macros, and new tools for extending default PowerPoint functions. Mainly, it supports \u201cadd-ins\u201d developed by third parties to add new features that attackers can abuse to automatically execute macros for further action on objectives.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Control Flow Diagram of Agent Tesla RAT (Version 3x)<\/strong><\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Infection Chain<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The initial vectors may vary depending on their targets and, it’s well known that the threat actors will perform basic reconnaissance methodologies before deciding on their method of infection.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Sample Information<\/strong><\/p>\n\n\n\n

PPT: 34c5d4ce20a550336303c0bdb5df78f6ed1727c3993e79e27d58f30ac5cbc055<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

File Metadata<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Technical Analysis of .PPAM Document<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When a user opens an office file containing macros, then the macros will execute from the Internet. We are well aware that the VBA macro is a common method for malicious actors to gain initial access to deploy malware. These files are based on the Office Open XML standard. This is an XML-based file format introduced by Microsoft<\/a> that is unreadable with PowerPoint versions earlier than MS Office 2010\/2013. Now, we can extract & view the contents of the file. The XML file format is human-readable or machine-readable and designed to transport data over the internet.<\/p>\n\n\n\n

The XML file format contains three categories:<\/p>\n\n\n\n