Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
Summary: Cisco Talos discovered a malware campaign that drops the Agent Tesla information-stealing trojan and the Loki stealer through a modified Microsoft Office exploit chain, using CVE-2017-0199 and CVE-2017-11882 to open an RTF document. The malicious RTF file, with SHA256 hash cf193637626e85b34a7ccaed9e4459b75605af46cedc95325583b879990e0e61, was flagged by only two of 58 antivirus engines on VirusTotal, while Cisco's Threat Grid identified it as malware.
Why it matters: Agent Tesla can steal login credentials from Chrome, Firefox, Outlook and other software, capture screenshots and record webcams, and the same distribution infrastructure also pushes Gamarue, which can completely take over a user's machine.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2017-0199CVE-2017-11882
- Related
- My Little Form Book Cyber Risks ·